VulnerabilityModified
CVE-2018-14666
An improper authorization flaw was found in the Smart Class feature of Foreman.
HIGH 7.2EPSS 1.05%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.05%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
An improper authorization flaw was found in the Smart Class feature of Foreman. An attacker can use it to change configuration of any host registered in Red Hat Satellite, independent of the organization the host belongs to. This flaw affects all Red Hat Satellite 6 versions.
- CVSS 3.0
- 7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.05% probability · 62th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-285, CWE-863
- Affected
- redhat/satellite
- Source
- secalert@redhat.com
References
- http://www.securityfocus.com/bid/106490Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14666Issue Tracking, Vendor Advisory
- http://www.securityfocus.com/bid/106490Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14666Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.