CVE-2024-6861

Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

CVSS 7.5 HIGHEPSS 0.7%CWE-200

Vexday Risk Score

21Baixo

Decisão SSVC (CISA)

Track

Sem sinal de exploração → monitorar

CVSS 7.5EPSS 0.7%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Ciclo de vida

06 nov 2024Publicada no NVD

Recomendação: Monitorar — sem sinal de exploração no momento.

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Produtos afetados

foremanRed Hat · Red Hat Satellite 6 Red Hat · Red Hat Satellite 6.12 for RHEL 8

Quer saber se a sua infraestrutura está exposta a isto?

Falar com a TrueHacking →

Referências

https://access.redhat.com/errata/RHSA-2022:8506 https://access.redhat.com/security/cve/CVE-2024-6861 https://bugzilla.redhat.com/show_bug.cgi?id=2317450 https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2 https://projects.theforeman.org/issues/34328