Description (CNA)
A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Not supplied / Not supplied | affected 0 before 3.3 |
| Red Hat / Red Hat Satellite 6.12 for RHEL 8 | unaffected 0:3.3.0.17-1.el8sat before * |
| Red Hat / Red Hat Satellite 6 | unaffected |
| Red Hat / Red Hat Satellite 6 | unaffected |
| Red Hat / Red Hat Satellite 6 | unaffected |
CWE
CWE-200
References
- https://access.redhat.com/errata/RHSA-2022:8506
- https://access.redhat.com/security/cve/CVE-2024-6861
- https://bugzilla.redhat.com/show_bug.cgi?id=2317450
- https://docs.theforeman.org/3.3/Release_Notes/index-katello.html#_foreman_2
- https://projects.theforeman.org/issues/34328
ADP enrichment
No English description supplied.
No references supplied.