CVE-2016-7077

MEDIUM

Foreman < 1.14.0 - Unauthenticated Information Disclosure via Form Helper

Title source: llm
STIX 2.1

Description

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.

References (4)

Core 4
Core References
Vendor Advisory x_refsource_confirm
https://theforeman.org/security.html#2016-7077
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7077
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94230
Exploit, Vendor Advisory x_refsource_confirm
https://projects.theforeman.org/issues/16971

Scores

CVSS v3 4.3
EPSS 0.0137
EPSS Percentile 68.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Details

CWE
CWE-200 CWE-285
Status published
Products (1)
theforeman/foreman < 1.14.0
Published Sep 10, 2018
Tracked Since Feb 18, 2026