Vulnerability · Published Apr 26, 2021 · Assigned by redhat
CVE-2021-3494
Medium 5.9
In plain English
A medium-severity security flaw in foreman. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS NVD)5.9Medium
Exploit odds (30 days)0.4%top 69.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.
Affected products (as reported)
Weakness: CWE-319
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1948005 x_refsource_MISC