A flaw was found in foreman before version 1.15 in the logging of adding and registering images.

Published 8 y ago 2018-06-21 · modified 4 mo ago 2026-06-17 · JSON

CVSS

6.5

v3.0 · CNA

CISA KEV

not known exploited

EPSS

1.2%

percentile 67%

Public exploits

none known

A flaw was found in foreman before version 1.15 in the logging of adding and registering images. An attacker with access to the foreman log file would be able to view passwords for provisioned systems in the log file, allowing them to access those systems.

Exploit prediction (EPSS)

1.16% probability of exploitation in the next 30 days, higher than 67% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
CNA	3.0	6.5	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	4.0	`AV:N/AC:L/Au:S/C:P/I:N/A:N`

Affected products

[UNKNOWN] foreman

Classification

Weakness

CWE-312 Cleartext Storage of Sensitive Information
CWE-269 Improper Privilege Management

References

projects.theforeman.org /issues/19169 · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2018:0336 · vendor-advisory, x_refsource_REDHAT, x_transferred
securityfocus.com /bid/97526 · vdb-entry, x_refsource_BID, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2672 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-2672
NVD: CVE-2017-2672

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.