CVE-2018-1096

Severity: medium (CVSS 6.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-04-05 · updated 2026-06-17
Weakness: CWE-89

Description

An input sanitization flaw was found in the id field in the dashboard controller of Foreman before 1.16.1. A user could use this flaw to perform an SQL injection attack on the back end database.

Affected products

Red Hat Satellite 6: 6.4
foreman: before 1.16.1 — fixed in 1.16.1

How to fix

Upgrade to a fixed version: foreman 1.16.1. Check the vendor advisory for mitigations.

References

http://projects.theforeman.org/issues/23028
https://access.redhat.com/errata/RHSA-2018:2927
https://bugzilla.redhat.com/show_bug.cgi?id=1561061
http://projects.theforeman.org/issues/23028
https://access.redhat.com/errata/RHSA-2018:2927
https://bugzilla.redhat.com/show_bug.cgi?id=1561061

Get alerted when CVE-2018-1096 or the next vulnerability affects your stack