CyberSec.Space Logo
Back to CVE Browser

CVE-2017-7505

HIGH
8.8
CVSS Severity Score
EPSS Score0.1080%
EPSS Percentile15.67th
PublishedMay 26, 2017
Last ModifiedMay 13, 2026

Vulnerability Description

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords.

Affected Platforms (CPE)

📦
Theforeman

Foreman

= 1.5.0
📦
Theforeman

Foreman

= 1.5.0
📦
Theforeman

Foreman

= 1.5.0
📦
Theforeman

Foreman

= 1.5.1
📦
Theforeman

Foreman

= 1.5.2
📦
Theforeman

Foreman

= 1.5.3
📦
Theforeman

Foreman

= 1.6.0
📦
Theforeman

Foreman

= 1.6.0
📦
Theforeman

Foreman

= 1.6.0
📦
Theforeman

Foreman

= 1.6.1
📦
Theforeman

Foreman

= 1.6.3
📦
Theforeman

Foreman

= 1.7.0
📦
Theforeman

Foreman

= 1.7.0
📦
Theforeman

Foreman

= 1.7.0
📦
Theforeman

Foreman

= 1.7.1
📦
Theforeman

Foreman

= 1.7.2
📦
Theforeman

Foreman

= 1.7.3
📦
Theforeman

Foreman

= 1.7.4
📦
Theforeman

Foreman

= 1.7.5
📦
Theforeman

Foreman

= 1.8.0
📦
Theforeman

Foreman

= 1.8.0
📦
Theforeman

Foreman

= 1.8.0
📦
Theforeman

Foreman

= 1.8.0
📦
Theforeman

Foreman

= 1.8.1
📦
Theforeman

Foreman

= 1.8.2
📦
Theforeman

Foreman

= 1.8.3
📦
Theforeman

Foreman

= 1.8.4
📦
Theforeman

Foreman

= 1.9.0
📦
Theforeman

Foreman

= 1.9.0
📦
Theforeman

Foreman

= 1.9.0
📦
Theforeman

Foreman

= 1.9.0
📦
Theforeman

Foreman

= 1.9.1
📦
Theforeman

Foreman

= 1.9.2
📦
Theforeman

Foreman

= 1.9.3
📦
Theforeman

Foreman

= 1.10.0
📦
Theforeman

Foreman

= 1.10.0
📦
Theforeman

Foreman

= 1.10.0
📦
Theforeman

Foreman

= 1.10.0
📦
Theforeman

Foreman

= 1.10.1
📦
Theforeman

Foreman

= 1.10.2
📦
Theforeman

Foreman

= 1.10.3
📦
Theforeman

Foreman

= 1.10.4
📦
Theforeman

Foreman

= 1.11.0
📦
Theforeman

Foreman

= 1.11.0
📦
Theforeman

Foreman

= 1.11.0
📦
Theforeman

Foreman

= 1.11.0
📦
Theforeman

Foreman

= 1.11.1
📦
Theforeman

Foreman

= 1.11.2
📦
Theforeman

Foreman

= 1.11.3
📦
Theforeman

Foreman

= 1.11.4
📦
Theforeman

Foreman

= 1.12.0
📦
Theforeman

Foreman

= 1.12.0
📦
Theforeman

Foreman

= 1.12.0
📦
Theforeman

Foreman

= 1.12.0
📦
Theforeman

Foreman

= 1.12.1
📦
Theforeman

Foreman

= 1.12.2
📦
Theforeman

Foreman

= 1.12.3
📦
Theforeman

Foreman

= 1.12.4
📦
Theforeman

Foreman

= 1.13.0
📦
Theforeman

Foreman

= 1.13.0
📦
Theforeman

Foreman

= 1.13.0
📦
Theforeman

Foreman

= 1.13.1
📦
Theforeman

Foreman

= 1.13.2
📦
Theforeman

Foreman

= 1.13.3
📦
Theforeman

Foreman

= 1.13.4
📦
Theforeman

Foreman

= 1.14.0
📦
Theforeman

Foreman

= 1.14.0
📦
Theforeman

Foreman

= 1.14.0
📦
Theforeman

Foreman

= 1.14.0
📦
Theforeman

Foreman

= 1.14.1
📦
Theforeman

Foreman

= 1.14.2
📦
Theforeman

Foreman

= 1.14.3
📦
Theforeman

Foreman

= 1.15.0
📦
Theforeman

Foreman

= 1.15.0
📦
Theforeman

Foreman

= 1.15.0

References & Advisories

🔗 http://projects.theforeman.org/issues/19612
🔗 http://www.securityfocus.com/bid/98607
🔗 https://github.com/theforeman/foreman/pull/4545
🔗 http://projects.theforeman.org/issues/19612
🔗 http://www.securityfocus.com/bid/98607
🔗 https://github.com/theforeman/foreman/pull/4545

Related Vulnerabilities

CVE-2018-146439.8

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this fl...

CVE-2017-75409.8

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Rub...

CVE-2016-44758.8

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticat...

CVE-2021-35908.8

A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSO...