{"answers":{"affected":"It affects 3 products.","exploited":"There is no known exploitation of CVE-2020-10716 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2020-10716 is a medium-severity vulnerability in Redhat Satellite, published on 27 May 2021. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2020-10716 and fix it if it is affected.\n\nWhat it is: CVE-2020-10716 is a medium-severity vulnerability in Redhat Satellite, published on 27 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2020-10716 in the wild and no public exploit code.\n\nAffected product: Redhat Satellite. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-10716/ (Markdown: https://insights.sbomify.com/CVE-2020-10716/index.md)","id":"CVE-2020-10716","markdown":"https://insights.sbomify.com/CVE-2020-10716/index.md","name":"CVE-2020-10716","record":{"aliases":["GHSA-w5v4-7h7x-xfvq"],"analysis":{"component_type":"server_software","fix_type":"upgrade","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Red Hat Satellite","requires_auth":"low_privilege","summary":"A malicious user can scan Job Invocations to expose sensitive data like passwords due to improper input restrictions in Red Hat Satellite.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"redhat","cpe":[{"product":"satellite","vendor":"redhat"},{"product":"satellite_capsule","vendor":"redhat"},{"product":"foreman_ansible","vendor":"theforeman"}],"cvss":{"score":6.5,"severity":"medium","source":"nvd","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"}],"description":"A flaw was found in Red Hat Satellite's Job Invocation, where the \"User Input\" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Information disclosure in rubygem-foreman ansible","id":"CVE-2020-10716","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"redhat:satellite","products":["redhat:satellite"],"type":"information_disclosure","year":"2020"},"n_packages":0,"n_references":2,"next":{"headline":"Denial of service in QEMU","id":"CVE-2020-10717"},"packages":[],"prev":{"headline":"Cross-site scripting in openshift/console","id":"CVE-2020-10715"},"products":["rubygem-foreman_ansible"],"published":"2021-05-27","related":[{"cvss_score":9.8,"headline":"Puppet-foreman: an authentication bypass vulnerability exists in foreman","id":"CVE-2024-7012","kev_date_added":null,"published":"2024-09-04"},{"cvss_score":9.8,"headline":"Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore","id":"CVE-2024-7923","kev_date_added":null,"published":"2024-09-04"},{"cvss_score":9.1,"headline":"Foreman: excessive permissions for viewer role on preview","id":"CVE-2026-96659","kev_date_added":null,"published":"2026-10-01"},{"cvss_score":9.1,"headline":"Foreman: arbitrary code execution through templates","id":"CVE-2023-0118","kev_date_added":null,"published":"2023-09-20"},{"cvss_score":9.1,"headline":"Hardcoded credentials in n/a","id":"CVE-2008-2369","kev_date_added":null,"published":"2008-08-14"},{"cvss_score":8.8,"headline":"Foreman: foreman: arbitrary code execution via safemode sandbox bypass","id":"CVE-2026-96658","kev_date_added":null,"published":"2026-10-01"},{"cvss_score":8.8,"headline":"Foreman: foreman: privilege escalation to administrator-level access via usergroup role assignment manipulation","id":"CVE-2026-5136","kev_date_added":null,"published":"2026-07-01"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["n/a"]},"summary":"A malicious user can scan Job Invocations to expose sensitive data like passwords due to improper input restrictions in Red Hat Satellite.","url":"https://insights.sbomify.com/CVE-2020-10716/"}