CVE-2013-2113

Redhat Openstack < 1.2.0 - Access Control

Title source: rule

Description

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.

Exploits (2)

exploitdb WORKING POC VERIFIED
by Metasploit · rubywebappslinux
https://www.exploit-db.com/exploits/27776
metasploit WORKING POC
rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/foreman_openstack_satellite_priv_esc.rb

Scores

EPSS 0.4745
EPSS Percentile 97.7%

Details

CWE
CWE-264
Status published
Products (3)
redhat/openstack 3.0
theforeman/foreman 1.1
theforeman/foreman < 1.2.0
Published Jul 31, 2013
Tracked Since Feb 18, 2026