Medium severity · published Sep 10, 2018
CVE-2016-7078
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature
4.3
CVSS
1.4%
EPSS
No
On KEV
Description
foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 72% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Foreman · Theforeman
1.15.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2016-7078
CVE.org
https://www.cve.org/CVERecord?id=CVE-2016-7078
Third Party Advisory
http://www.securityfocus.com/bid/96385
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078
Third Party Advisory
https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905
Vendor Advisory
https://projects.theforeman.org/issues/16982
Mailing List
https://seclists.org/oss-sec/2017/q1/470
Vendor Advisory
https://theforeman.org/security.html#2016-7078
More from Foreman
9.8
CVE-2018-14643
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman
9.1
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview
9.1
CVE-2022-3874
A command injection flaw was found in foreman
9.1
CVE-2023-0462
An arbitrary code execution flaw was found in Foreman
9.1
CVE-2023-0118
An arbitrary code execution flaw was found in Foreman