CVE-2019-10198 - CVE House
Back to Database
Status published Medium CVE-2019-10198

An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7....

Vulnerability Description

An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2019-10198

Credits & Attribution

No credits recorded in the NVD database.

References

More from The Foreman Project

View All →
CVE-2019-3893
In Foreman it was discovered that the delete compute resource...
Medium 4.9
CVE-2018-16861
A cross-site scripting (XSS) flaw was found in the foreman...
High 7.6
CVE-2018-14623
A SQL injection flaw was found in katello's errata-related API....
Medium 4.3
CVE-2017-2662
A flaw was found in Foreman's katello plugin version 3.4.5....
Medium 4.3
CVE-2016-8639
It was found that foreman before 1.13.0 is vulnerable to...
Medium 6.1

Affected Vendor

The Foreman Project

View all reports →

Affected Software

foreman-tasks
Vulnerable Versions:
0.15.7

Timeline

Official Publish: July 31st, 2019
Last Modified: August 4th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-592

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.