CVE-2021-20290

Published: Mar 25, 2022Modified: Nov 21, 2024

6.1

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Exploitability: 1.8 / Impact: 4.2

Source: NVD

Description

An improper authorization handling flaw was found in Foreman. The OpenSCAP plugin for the smart-proxy allows foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.

Affected (1)

Products: Theforeman: Openscap

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Theforeman Openscap	Before 0.9.1

Related CWEs

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://bugzilla.redhat.com/show_bug.cgi?id=1939701

Source: secalert@redhat.com

ExploitIssue TrackingMitigationThird Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1939701

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingMitigationThird Party Advisory

Timeline

No history available yet.