VULNERABILITY INTELLIGENCE

CVE-2016-7078

CVSS score4.3 MEDIUM
EPSS probability1.36%
CISA KEVNot currently listed
Published2018-09-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Description

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.

Weakness classification

  • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-285: Improper Authorization

Primary references