Unscored severity · published May 8, 2014
CVE-2014-0192
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote attackers to obtain sensitive information via the hostname parameter, related to "spoof."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Foreman · Theforeman
1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0192
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0192
Exploit
http://projects.theforeman.org/issues/5436
Vendor Advisory
http://theforeman.org/security.html
Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1092354
More from Foreman
9.8
CVE-2018-14643
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman
9.1
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview
9.1
CVE-2022-3874
A command injection flaw was found in foreman
9.1
CVE-2023-0462
An arbitrary code execution flaw was found in Foreman
9.1
CVE-2023-0118
An arbitrary code execution flaw was found in Foreman