CVE-2017-2672: redhat satellite
Vulnerability summary
CVE-2017-2672 is a high (CVSS 8.8) vulnerability in redhat satellite. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 67.8% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 21-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.
CVSS metrics
3 scores · 2 sources · 2 versions- CVE.orgCNA6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NDiffers
EPSS trend
Probability
1.21%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
0.00 pp
From 1.21% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (projects.theforeman.org)
Maturity: unknown
Exploit Reference (bugzilla.redhat.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-312Cleartext Storage of Sensitive InformationThe product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
- CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected systems
3 vendors · 3 products
References
4 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2672X Refsource CONFIRMExploitIssue TrackingThird Party Advisory