CVE-2020-10716

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-05-27 · updated 2026-06-17
Weakness: CWE-285

Description

A flaw was found in Red Hat Satellite's Job Invocation, where the "User Input" entry was not properly restricted to the view. This flaw allows a malicious Satellite user to scan through the Job Invocation, with the ability to search for passwords and other sensitive data. This flaw affects tfm-rubygem-foreman_ansible versions before 4.0.3.4.

Affected products

Red Hat Satellite 6: 6.7
RedHat Satellite Capsule: 6.7
theforeman Foreman Ansible: before 4.0.3.4 — fixed in 4.0.3.4

How to fix

Upgrade to a fixed version: theforeman Foreman Ansible 4.0.3.4. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1814998
https://bugzilla.redhat.com/show_bug.cgi?id=1827300
https://bugzilla.redhat.com/show_bug.cgi?id=1814998
https://bugzilla.redhat.com/show_bug.cgi?id=1827300

Get alerted when CVE-2020-10716 or the next vulnerability affects your stack