FKIE_CVE-2024-8553

Vulnerability from fkie_nvd - Published: 2024-10-31 15:15 - Updated: 2024-11-06 09:15
Severity ?
6.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Summary
A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information.
References
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:8717
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:8718
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:8719
secalert@redhat.comhttps://access.redhat.com/errata/RHSA-2024:8906
secalert@redhat.comhttps://access.redhat.com/security/cve/CVE-2024-8553
secalert@redhat.comhttps://bugzilla.redhat.com/show_bug.cgi?id=2312524
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in Foreman\u0027s loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman\u0027s database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information."
    },
    {
      "lang": "es",
      "value": "Se encontr\u00f3 una vulnerabilidad en las macros de carga de Foreman introducidas con las plantillas de informes. Estas macros pueden permitir que un usuario autenticado con permisos para ver y crear plantillas lea cualquier campo de la base de datos de Foreman. Al usar cadenas espec\u00edficas en las macros de carga, los usuarios pueden omitir los permisos y acceder a informaci\u00f3n confidencial."
    }
  ],
  "id": "CVE-2024-8553",
  "lastModified": "2024-11-06T09:15:04.370",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.4,
        "source": "secalert@redhat.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2024-10-31T15:15:17.243",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:8717"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:8718"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:8719"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHSA-2024:8906"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/security/cve/CVE-2024-8553"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2312524"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "secalert@redhat.com",
      "type": "Secondary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.