CVE-2016-7077

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-10 · updated 2026-06-17
Weakness: CWE-285

Description

foreman before 1.14.0 is vulnerable to an information leak. It was found that Foreman form helper does not authorize options for associated objects. Unauthorized user can see names of such objects if their count is less than 6.

Affected products

foreman: before 1.14.0 — fixed in 1.14.0

How to fix

Upgrade to a fixed version: foreman 1.14.0. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/94230
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7077
https://projects.theforeman.org/issues/16971
https://theforeman.org/security.html#2016-7077
http://www.securityfocus.com/bid/94230
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7077
https://projects.theforeman.org/issues/16971
https://theforeman.org/security.html#2016-7077

Get alerted when CVE-2016-7077 or the next vulnerability affects your stack