Medium severity · published Oct 31, 2024
CVE-2024-8553
Foreman: read-only access to entire db from templates
6.3
CVSS
0.4%
EPSS
No
On KEV
Description
A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Satellite 6.13 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Satellite 6.14 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Satellite 6.15 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Satellite 6.16 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Satellite 6.16 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
Affected product
RH
Red Hat Satellite 6.13 for RHEL 8
Red Hat
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-8553
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-8553
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8717
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8718
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8719
access.redhat.com
https://access.redhat.com/errata/RHSA-2024:8906
access.redhat.com
https://access.redhat.com/security/cve/CVE-2024-8553
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2312524
More from Red Hat Satellite 6.13 for RHEL 8
9.8
CVE-2024-7923
Puppet-pulpcore: an authentication bypass vulnerability exists in pulpcore
9.8
CVE-2024-7012
Puppet-foreman: an authentication bypass vulnerability exists in foreman