CVE-2014-8183

HIGH

Foreman 1.x.x < 1.15.6 - Improper Access Control via API Resource Name

Title source: llm
STIX 2.1

Description

It was found that foreman, versions 1.x.x before 1.15.6, in Satellite 6 did not properly enforce access controls on certain resources. An attacker with access to the API and knowledge of the resource name can access resources in other organizations.

References (1)

Core 1
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8183

Scores

CVSS v3 7.4
EPSS 0.0075
EPSS Percentile 50.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Details

CWE
CWE-284
Status published
Products (2)
redhat/satellite 6.0
theforeman/foreman 1.0 - 1.15.6
Published Aug 01, 2019
Tracked Since Feb 18, 2026