Unscored severity · published Aug 14, 2015
CVE-2015-1816
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate
–
CVSS
0.9%
EPSS
No
On KEV
Description
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 61% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Foreman · Theforeman
through 1.7.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1816
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1816
Vendor Advisory
http://projects.theforeman.org/issues/9858
access.redhat.com
https://access.redhat.com/errata/RHSA-2015:1591
access.redhat.com
https://access.redhat.com/errata/RHSA-2015:1592
github.com
https://github.com/theforeman/foreman/pull/2265
groups.google.com
https://groups.google.com/forum/#%21topic/foreman-announce/9ZnuPcplNLI
More from Foreman
9.8
CVE-2018-14643
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman
9.1
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview
9.1
CVE-2022-3874
A command injection flaw was found in foreman
9.1
CVE-2023-0462
An arbitrary code execution flaw was found in Foreman
9.1
CVE-2023-0118
An arbitrary code execution flaw was found in Foreman