CVE-2017-2662
Advisory lineage Upstream: 0 Downstream: 1
Downstream
Modified
Published: 22 Aug 2018, 16:00
Last modified:05 Aug 2024, 14:02
Vulnerability Summary
Overall Risk (default)
low
17/100 CVSS Score
4.3 MEDIUM
v3.0 (cve.org)
EPSS Score
0.09% LOW
0% probability -0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected
Timeline
22 Aug 2018, 16:00
Published
Vulnerability first disclosed
05 Aug 2024, 14:02
Last Modified
Vulnerability information updated
Description
A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.
CVSS Metrics
- v3.0•MEDIUM•Score: 4.3CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- v2.0•MEDIUM•Score: 4AV:N/AC:L/Au:S/C:P/I:N/A:N
EPSS Trends
Current EPSS score: 0.09%• Percentile: 25%
Techniques & Countermeasures
- CWE-269•Improper Privilege Management
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- CWE-862•Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Affected Systems
- the foreman project•foreman katello plugin
3.4.5
- theforeman•katello
3.4.5