CVE-2016-7078

Severity: medium (CVSS 4.3 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-10 · updated 2026-06-17
Weakness: CWE-285

Description

foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.

Affected products

foreman: 1.15.0

References

http://www.securityfocus.com/bid/96385
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078
https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905
https://projects.theforeman.org/issues/16982
https://seclists.org/oss-sec/2017/q1/470
https://theforeman.org/security.html#2016-7078
http://www.securityfocus.com/bid/96385
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078
https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905
https://projects.theforeman.org/issues/16982
https://seclists.org/oss-sec/2017/q1/470
https://theforeman.org/security.html#2016-7078

Get alerted when CVE-2016-7078 or the next vulnerability affects your stack