CVE-2016-7077: foreman Improper Authorization

Vulnerability summary

CVE-2016-7077 is a medium (CVSS 4.3) Improper Authorization vulnerability in foreman. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 71.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 10-09-2018
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.

• CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
• CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.