foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
| Link | Tags |
|---|---|
| https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905 | third party advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078 | issue tracking third party advisory |
| http://www.securityfocus.com/bid/96385 | vdb entry third party advisory |
| https://theforeman.org/security.html#2016-7078 | vendor advisory |
| https://projects.theforeman.org/issues/16982 | vendor advisory |
| https://seclists.org/oss-sec/2017/q1/470 | third party advisory mailing list |