8.1

CVE-2015-5152

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Theforeman ≫ Foreman Version 1.1-1
Theforeman ≫ Foreman Version 1.2.0
Theforeman ≫ Foreman Version 1.2.0 Update rc1
Theforeman ≫ Foreman Version 1.2.0 Update rc2
Theforeman ≫ Foreman Version 1.2.0 Update rc3
Theforeman ≫ Foreman Version 1.2.1
Theforeman ≫ Foreman Version 1.2.2
Theforeman ≫ Foreman Version 1.2.3
Theforeman ≫ Foreman Version 1.3.0
Theforeman ≫ Foreman Version 1.3.0 Update rc1
Theforeman ≫ Foreman Version 1.3.0 Update rc2
Theforeman ≫ Foreman Version 1.3.0 Update rc3
Theforeman ≫ Foreman Version 1.3.0 Update rc4
Theforeman ≫ Foreman Version 1.3.1
Theforeman ≫ Foreman Version 1.3.2
Theforeman ≫ Foreman Version 1.4.0
Theforeman ≫ Foreman Version 1.4.0 Update rc1
Theforeman ≫ Foreman Version 1.4.0 Update rc2
Theforeman ≫ Foreman Version 1.4.1
Theforeman ≫ Foreman Version 1.4.2
Theforeman ≫ Foreman Version 1.4.3
Theforeman ≫ Foreman Version 1.4.4
Theforeman ≫ Foreman Version 1.4.5
Theforeman ≫ Foreman Version 1.5.0
Theforeman ≫ Foreman Version 1.5.1
Theforeman ≫ Foreman Version 1.5.2
Theforeman ≫ Foreman Version 1.5.3
Theforeman ≫ Foreman Version 1.6.0
Theforeman ≫ Foreman Version 1.6.0 Update rc1
Theforeman ≫ Foreman Version 1.6.0 Update rc2
Theforeman ≫ Foreman Version 1.6.1
Theforeman ≫ Foreman Version 1.7.0
Theforeman ≫ Foreman Version 1.7.0 Update rc1
Theforeman ≫ Foreman Version 1.7.0 Update rc2
Theforeman ≫ Foreman Version 1.7.1
Theforeman ≫ Foreman Version 1.7.2
Theforeman ≫ Foreman Version 1.7.3
Theforeman ≫ Foreman Version 1.7.4
Theforeman ≫ Foreman Version 1.7.5
Theforeman ≫ Foreman Version 1.8.0
Theforeman ≫ Foreman Version 1.8.0 Update rc1
Theforeman ≫ Foreman Version 1.8.0 Update rc2
Theforeman ≫ Foreman Version 1.8.0 Update rc3
Theforeman ≫ Foreman Version 1.8.1
Theforeman ≫ Foreman Version 1.8.2
Theforeman ≫ Foreman Version 1.8.3
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.51% 0.712
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 8.1 2.2 5.9
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

http://projects.theforeman.org/issues/11119
Vendor Advisory
Mailing List
https://bugzilla.redhat.com/show_bug.cgi?id=1243571
Third Party Advisory
Issue Tracking
Mitigation