Ecosyste.ms: Advisories

Security Advisories: MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWYycnAtNHJ2Ny1mYzk1

Exposure of Sensitive Information to an Unauthorized Actor in foreman_fog_proxmox

A flaw was found in the Foreman project. The Proxmox compute resource exposes the password through the API to an authenticated local attacker with view_hosts permission. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. Versions of foreman_fog_proxmox prior to 0.13.1 are affected.

Permalink: https://github.com/advisories/GHSA-f2rp-4rv7-fc95
JSON: https://advisories.ecosyste.ms/api/v1/advisories/MDE2OlNlY3VyaXR5QWR2aXNvcnlHSFNBLWYycnAtNHJ2Ny1mYzk1
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: almost 3 years ago
Updated: over 1 year ago

CVSS Score: 7.8
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Identifiers: GHSA-f2rp-4rv7-fc95, CVE-2021-20259
References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-20259
• https://github.com/theforeman/foreman_fog_proxmox/pull/184/commits/b7e910bf61563f5d447c71b1b41e2a373a794d7b
• https://bugzilla.redhat.com/show_bug.cgi?id=1932144
• https://github.com/theforeman/foreman_fog_proxmox/releases/tag/v0.13.1
• https://github.com/advisories/GHSA-f2rp-4rv7-fc95

Repository: https://github.com/theforeman/foreman_fog_proxmox
Blast Radius: 0.0

Affected Packages