CVE-2017-7505: foreman Incorrect Authorization

Vulnerability summary

CVE-2017-7505 is a high (CVSS 8.8) Incorrect Authorization vulnerability in foreman. EPSS estimates a 1.59% chance of exploitation in the next 30 days, higher than 75.2% of scored vulnerabilities.

Timeline

1. 26-05-2017
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
• CWE-269Improper Privilege ManagementThe product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.