CVE-2020-10716 Information disclosure in rubygem-foreman ansible
A malicious user can scan Job Invocations to expose sensitive data like passwords due to improper input restrictions in Red Hat Satellite.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10716?
CVE-2020-10716 is a medium-severity vulnerability in Redhat Satellite, published on 27 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.
Weakness: CWE-285
Which versions are affected by CVE-2020-10716?
It affects 3 products.
Products include Redhat Satellite, Redhat Satellite Capsule, Theforeman Foreman Ansible.
How do I fix CVE-2020-10716?
Upgrade to a fixed version.
Is CVE-2020-10716 being exploited?
There is no known exploitation of CVE-2020-10716 in the wild and no public exploit code.
Other vulnerabilities in Redhat Satellite
- CVE-2024-7012 Puppet-foreman: an authentication bypass vulnerability exists in foreman
- CVE-2024-7923 Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
- CVE-2026-96659 Foreman: excessive permissions for viewer role on preview
- CVE-2023-0118 Foreman: arbitrary code execution through templates
- CVE-2008-2369 Hardcoded credentials in n/a
Sources
Also known as GHSA-w5v4-7h7x-xfvq.