8.1

CVE-2015-5152

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Theforeman ≫ Foreman Version1.1-1
Theforeman ≫ Foreman Version1.2.0
Theforeman ≫ Foreman Version1.2.0 Updaterc1
Theforeman ≫ Foreman Version1.2.0 Updaterc2
Theforeman ≫ Foreman Version1.2.0 Updaterc3
Theforeman ≫ Foreman Version1.2.1
Theforeman ≫ Foreman Version1.2.2
Theforeman ≫ Foreman Version1.2.3
Theforeman ≫ Foreman Version1.3.0
Theforeman ≫ Foreman Version1.3.0 Updaterc1
Theforeman ≫ Foreman Version1.3.0 Updaterc2
Theforeman ≫ Foreman Version1.3.0 Updaterc3
Theforeman ≫ Foreman Version1.3.0 Updaterc4
Theforeman ≫ Foreman Version1.3.1
Theforeman ≫ Foreman Version1.3.2
Theforeman ≫ Foreman Version1.4.0
Theforeman ≫ Foreman Version1.4.0 Updaterc1
Theforeman ≫ Foreman Version1.4.0 Updaterc2
Theforeman ≫ Foreman Version1.4.1
Theforeman ≫ Foreman Version1.4.2
Theforeman ≫ Foreman Version1.4.3
Theforeman ≫ Foreman Version1.4.4
Theforeman ≫ Foreman Version1.4.5
Theforeman ≫ Foreman Version1.5.0
Theforeman ≫ Foreman Version1.5.1
Theforeman ≫ Foreman Version1.5.2
Theforeman ≫ Foreman Version1.5.3
Theforeman ≫ Foreman Version1.6.0
Theforeman ≫ Foreman Version1.6.0 Updaterc1
Theforeman ≫ Foreman Version1.6.0 Updaterc2
Theforeman ≫ Foreman Version1.6.1
Theforeman ≫ Foreman Version1.7.0
Theforeman ≫ Foreman Version1.7.0 Updaterc1
Theforeman ≫ Foreman Version1.7.0 Updaterc2
Theforeman ≫ Foreman Version1.7.1
Theforeman ≫ Foreman Version1.7.2
Theforeman ≫ Foreman Version1.7.3
Theforeman ≫ Foreman Version1.7.4
Theforeman ≫ Foreman Version1.7.5
Theforeman ≫ Foreman Version1.8.0
Theforeman ≫ Foreman Version1.8.0 Updaterc1
Theforeman ≫ Foreman Version1.8.0 Updaterc2
Theforeman ≫ Foreman Version1.8.0 Updaterc3
Theforeman ≫ Foreman Version1.8.1
Theforeman ≫ Foreman Version1.8.2
Theforeman ≫ Foreman Version1.8.3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.24% 0.445
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://projects.theforeman.org/issues/11119
Vendor Advisory
Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=1243571
Third Party Advisory
Issue Tracking
Mitigation