CVE-2024-8553
Foreman: read-only access to entire db from templates
CVSS Score
6.3
EPSS Score
0.0%
EPSS Percentile
0th
A vulnerability was found in Foreman's loader macros introduced with report templates. These macros may allow an authenticated user with permissions to view and create templates to read any field from Foreman's database. By using specific strings in the loader macros, users can bypass permissions and access sensitive information.
| CWE | CWE-200 |
| Published | Oct 31, 2024 |
| Last Updated | Nov 11, 2025 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new medium vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Affected Versions
Red Hat / Red Hat Satellite 6.13 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.14 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.15 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.16 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.16 for RHEL 9
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2024:8717 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:8718 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:8719 access.redhat.com: https://access.redhat.com/errata/RHSA-2024:8906 access.redhat.com: https://access.redhat.com/security/cve/CVE-2024-8553 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2312524