Back to CVE Browser

CVE-2021-3590

HIGH

8.8

CVSS Severity Score

EPSS Score0.0740%

EPSS Percentile21.24th

PublishedAug 22, 2022

Last ModifiedNov 21, 2024

Vulnerability Description

A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile password through JSON of the API output. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

Affected Platforms (CPE)

📦

Theforeman

Foreman

>= 1.6.0

📦

Redhat

Satellite

= 6.0

References & Advisories

🔗 https://access.redhat.com/security/cve/CVE-2021-3590

🔗 https://bugzilla.redhat.com/show_bug.cgi?id=1969258

🔗 https://access.redhat.com/security/cve/CVE-2021-3590

🔗 https://bugzilla.redhat.com/show_bug.cgi?id=1969258

Related Vulnerabilities

CVE-2018-146439.8

An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this fl...

CVE-2017-75409.8

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Rub...

CVE-2017-75058.8

Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who...

CVE-2016-37288.8

Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11....