CVE-2017-7505
Summary
| CVE | CVE-2017-7505 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2017-05-26 16:29:00 UTC |
| Updated | 2025-04-20 01:37:25 UTC |
| Description | Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords. |
Risk And Classification
Primary CVSS: v3.0 8.8 HIGH from [email protected]
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Problem Types: CWE-863 | CWE-269 | CWE-863 CWE-863
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.0 | [email protected] | Primary | 8.8 | HIGH | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | [email protected] | Primary | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P |
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:L/Au:S/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Theforeman | Foreman | 1.10.0 | All | All | All |
| Application | Theforeman | Foreman | 1.10.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.10.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.10.0 | rc3 | All | All |
| Application | Theforeman | Foreman | 1.10.1 | All | All | All |
| Application | Theforeman | Foreman | 1.10.2 | All | All | All |
| Application | Theforeman | Foreman | 1.10.3 | All | All | All |
| Application | Theforeman | Foreman | 1.10.4 | All | All | All |
| Application | Theforeman | Foreman | 1.11.0 | All | All | All |
| Application | Theforeman | Foreman | 1.11.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.11.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.11.0 | rc3 | All | All |
| Application | Theforeman | Foreman | 1.11.1 | All | All | All |
| Application | Theforeman | Foreman | 1.11.2 | All | All | All |
| Application | Theforeman | Foreman | 1.11.3 | All | All | All |
| Application | Theforeman | Foreman | 1.11.4 | All | All | All |
| Application | Theforeman | Foreman | 1.12.0 | All | All | All |
| Application | Theforeman | Foreman | 1.12.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.12.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.12.0 | rc3 | All | All |
| Application | Theforeman | Foreman | 1.12.1 | All | All | All |
| Application | Theforeman | Foreman | 1.12.2 | All | All | All |
| Application | Theforeman | Foreman | 1.12.3 | All | All | All |
| Application | Theforeman | Foreman | 1.12.4 | All | All | All |
| Application | Theforeman | Foreman | 1.13.0 | All | All | All |
| Application | Theforeman | Foreman | 1.13.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.13.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.13.1 | All | All | All |
| Application | Theforeman | Foreman | 1.13.2 | All | All | All |
| Application | Theforeman | Foreman | 1.13.3 | All | All | All |
| Application | Theforeman | Foreman | 1.13.4 | All | All | All |
| Application | Theforeman | Foreman | 1.14.0 | All | All | All |
| Application | Theforeman | Foreman | 1.14.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.14.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.14.0 | rc3 | All | All |
| Application | Theforeman | Foreman | 1.14.1 | All | All | All |
| Application | Theforeman | Foreman | 1.14.2 | All | All | All |
| Application | Theforeman | Foreman | 1.14.3 | All | All | All |
| Application | Theforeman | Foreman | 1.15.0 | All | All | All |
| Application | Theforeman | Foreman | 1.15.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.15.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.5.0 | All | All | All |
| Application | Theforeman | Foreman | 1.5.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.5.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.5.1 | All | All | All |
| Application | Theforeman | Foreman | 1.5.2 | All | All | All |
| Application | Theforeman | Foreman | 1.5.3 | All | All | All |
| Application | Theforeman | Foreman | 1.6.0 | All | All | All |
| Application | Theforeman | Foreman | 1.6.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.6.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.6.1 | All | All | All |
| Application | Theforeman | Foreman | 1.6.3 | All | All | All |
| Application | Theforeman | Foreman | 1.7.0 | All | All | All |
| Application | Theforeman | Foreman | 1.7.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.7.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.7.1 | All | All | All |
| Application | Theforeman | Foreman | 1.7.2 | All | All | All |
| Application | Theforeman | Foreman | 1.7.3 | All | All | All |
| Application | Theforeman | Foreman | 1.7.4 | All | All | All |
| Application | Theforeman | Foreman | 1.7.5 | All | All | All |
| Application | Theforeman | Foreman | 1.8.0 | All | All | All |
| Application | Theforeman | Foreman | 1.8.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.8.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.8.0 | rc3 | All | All |
| Application | Theforeman | Foreman | 1.8.1 | All | All | All |
| Application | Theforeman | Foreman | 1.8.2 | All | All | All |
| Application | Theforeman | Foreman | 1.8.3 | All | All | All |
| Application | Theforeman | Foreman | 1.8.4 | All | All | All |
| Application | Theforeman | Foreman | 1.9.0 | All | All | All |
| Application | Theforeman | Foreman | 1.9.0 | rc1 | All | All |
| Application | Theforeman | Foreman | 1.9.0 | rc2 | All | All |
| Application | Theforeman | Foreman | 1.9.0 | rc3 | All | All |
| Application | Theforeman | Foreman | 1.9.1 | All | All | All |
| Application | Theforeman | Foreman | 1.9.2 | All | All | All |
| Application | Theforeman | Foreman | 1.9.3 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug #19612: CVE-2017-7505: User scoped in organization with permissions for user management can manage administrators that are not assigned to any organization - Foreman | af854a3a-2127-422b-91ae-364da2661108 | projects.theforeman.org | Issue Tracking, Patch, Vendor Advisory |
| Fixes #19612 - CVE-2017-7505 don't expose admin to taxed users by ares · Pull Request #4545 · theforeman/foreman · GitHub | af854a3a-2127-422b-91ae-364da2661108 | github.com | Patch, Vendor Advisory |
| Foreman CVE-2017-7505 Remote Privilege Escalation Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.