VulnerabilityModified
CVE-2013-2113
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
MEDIUM 6.0EPSS 20.9%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 20.9%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 20.93% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- redhat/openstack · theforeman/foreman
- Source
- secalert@redhat.com
References
- http://projects.theforeman.org/issues/2630
- http://rhn.redhat.com/errata/RHSA-2013-0995.html
- https://bugzilla.redhat.com/show_bug.cgi?id=968166
- https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXU
- http://projects.theforeman.org/issues/2630
- http://rhn.redhat.com/errata/RHSA-2013-0995.html
- https://bugzilla.redhat.com/show_bug.cgi?id=968166
- https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXU
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.