VULNERABILITY INTELLIGENCE

CVE-2017-7505

CVSS score8.8 HIGH

EPSS probability1.59%

CISA KEVNot currently listed

Published2017-05-26

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Description

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords.

Weakness classification

CWE-269: Improper Privilege Management
CWE-863: Incorrect Authorization

Primary references

secalert@redhat.com — Issue Tracking, Patch, Vendor Advisory
secalert@redhat.com — Third Party Advisory, VDB Entry
secalert@redhat.com — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory