CVE-2019-10198 Auth bypass in foreman-tasks
An unauthenticated attacker can view task details in Foreman by guessing UUIDs due to missing authorization checks in the foreman-tasks plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10198?
CVE-2019-10198 is a medium-severity authentication bypass vulnerability in Redhat Satellite, published on 31 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.
Which versions are affected by CVE-2019-10198?
It affects 2 products.
Products include Redhat Satellite, Theforeman Foreman-Tasks.
How do I fix CVE-2019-10198?
Upgrade to a fixed version.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-10198 being exploited?
There is no known exploitation of CVE-2019-10198 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
- CVE-2023-0118 Foreman: arbitrary code execution through templates
- CVE-2008-2369 Hardcoded credentials in n/a
Sources
Also known as GHSA-gq5x-r3g9-ch4f.