Foreman CVE-2013-0187

MEDIUM

Permissions, Privileges, and Access Controls (CWE-264)

2014-05-08 secalert@redhat.com

Privilege Escalation Foreman

6.5

CVSS 2.0 · NVD

Share

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/Au:S/C:P/I:P/A:P

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:S/C:P/I:P/A:P

Attack Vector

Network

Attack Complexity

Low

Confidentiality

P

Integrity

P

Availability

P

Lifecycle Timeline

1

CVE Published

May 08, 2014 - 14:29 cve.org

MEDIUM 6.5

DescriptionCVE.org

Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request.

AnalysisAI

Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-264. Foreman before 1.1 allows remote authenticated users to gain privileges via a (1) XMLHttpRequest or (2) AJAX request. Affected products include: Theforeman Foreman. Version information: before 1.1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Foreman

View all

CVE-2013-2121 MEDIUM This Month POC

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote

CVE-2013-2113 MEDIUM This Month POC

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users w

CVE-2014-0007 HIGH This Week POC

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via

CVE-2018-14643 CRITICAL Act Now

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. Rated critical severity (C

CVE-2014-0208 MEDIUM This Month POC

Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remo

CVE-2016-3728 HIGH This Week

Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x be

CVE-2023-0462 CRITICAL Act Now

An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel

CVE-2023-0118 CRITICAL Act Now

An arbitrary code execution flaw was found in Foreman. Rated critical severity (CVSS 9.1), this vulnerability is remotel

CVE-2014-0192 MEDIUM This Month POC

Foreman 1.4.0 before 1.5.0 does not properly restrict access to provisioning template previews, which allows remote atta

CVE-2017-7505 HIGH This Week

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management perm

CVE-2016-4475 HIGH This Week

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote a

CVE-2018-1097 HIGH This Week

A flaw was found in foreman before 1.16.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, l

Same weakness CWE-264 – Permissions, Privileges, and Access Controls

View all

CVE-2013-0422 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

CVE-2015-7709 CRITICAL POC

CVE-2014-0514 CRITICAL POC

CVE-2013-6955 CRITICAL POC

CVE-2012-0299 CRITICAL POC

Same technique Privilege Escalation

View all

CVE-2025-47812 CRITICAL POC

CVE-2013-0422 CRITICAL POC

CVE-2013-0632 CRITICAL POC

CVE-2017-5689 CRITICAL POC

CVE-2017-12635 CRITICAL POC

CVE-2016-10372 CRITICAL POC

CVE-2014-9583 CRITICAL POC

CVE-2012-0297 CRITICAL POC

Share

CVE-2013-0187 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy