Vulnerability · Published Jun 3, 2021 · Assigned by redhat

CVE-2021-3469

Medium 5.4

In plain English

A medium-severity incorrect authorization in Foreman. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities).

Severity (CVSS NVD)5.4Medium

Exploit odds (30 days)0.3%top 73.6% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.

Affected products (as reported)

Vendor	Product	Versions
n/a	Foreman	foreman 2.3.4, foreman 2.4.0

Weakness: CWE-863

References

https://bugzilla.redhat.com/show_bug.cgi?id=1943630 x_refsource_MISC