CVE-2018-1097

A flaw was found in foreman before 1.16.1. The issue allows users with limited permissions for powering oVirt/RHV hosts on and off to discover the username and password used to connect to the compute resource.

Score

CVSS 3.0 8.8 High

Status

Modified - secalert@redhat.com

Published

2018-04-04

Last modified

2024-08-05

Weaknesses

CWE-200

Affected products

• Foreman (Foreman Project)
• Satellite (Redhat)
• Foreman (Theforeman)

References

• https://access.redhat.com/errata/RHSA-2018:2927
• https://bugzilla.redhat.com/show_bug.cgi?id=1561723
• https://github.com/theforeman/foreman/pull/5369
• https://projects.theforeman.org/issues/22546