CVE-2016-5390

Severity: medium (CVSS 5.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-08-19 · updated 2026-06-17
Weakness: CWE-200

Description

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.

Affected products

foreman: from 1.11.0 before 1.11.4; from 1.12.0 before 1.12.1 — fixed in 1.11.4, 1.12.1

How to fix

Upgrade to a fixed version: foreman 1.11.4, 1.12.1. Check the vendor advisory for mitigations.

References

http://projects.theforeman.org/issues/15653
http://www.securityfocus.com/bid/91770
https://bugzilla.redhat.com/show_bug.cgi?id=1355728
https://theforeman.org/security.html#2016-5390
http://projects.theforeman.org/issues/15653
http://www.securityfocus.com/bid/91770
https://bugzilla.redhat.com/show_bug.cgi?id=1355728
https://theforeman.org/security.html#2016-5390

Get alerted when CVE-2016-5390 or the next vulnerability affects your stack