Test ID:	1.3.6.1.4.1.25623.1.0.106419
Category:	Web application abuses
Title:	Foreman 1.10.x < 1.11.4, 1.12.0 Information Disclosure Vulnerability
Summary:	Foreman is prone to an information disclosure; vulnerability.
Description:	Summary: Foreman is prone to an information disclosure vulnerability. Vulnerability Insight: Non-admin users with the view_hosts permission containing a filter are able to access API routes beneath 'hosts' such as GET /api/v2/hosts/secrethost/interfaces without the filter being taken into account. This allows users to access network interface details (including BMC login details) for any host. Affected Software/OS: Foreman version 1.10.x prior to 1.11.4 and 1.12.0 only. Solution: Update to version 1.11.4, 1.12.1 or later. CVSS Score: 3.5 CVSS Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-5390 91770 http://www.securityfocus.com/bid/91770 http://projects.theforeman.org/issues/15653 https://bugzilla.redhat.com/show_bug.cgi?id=1355728 https://theforeman.org/security.html#2016-5390
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.