An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2019-07-31T21:44:19

Updated: 2024-08-04T22:17:19.748Z

Reserved: 2019-03-27T00:00:00

Link: CVE-2019-10198

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Analyzed

Published: 2019-07-31T22:15:12.590

Modified: 2020-09-30T18:16:14.837

Link: CVE-2019-10198

cve-icon Redhat

Severity : Moderate

Publid Date: 2019-07-12T00:00:00Z

Links: CVE-2019-10198 - Bugzilla