CVE-2015-5152

Опубликовано: 17 июл. 2017

Источник: nvd

CVSS3: 8.1

CVSS2: 4.3

EPSS Низкий

Описание

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.

Ссылки

http://projects.theforeman.org/issues/11119
Mailing List
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1243571
Issue Tracking
Mitigation
Third Party Advisory
http://projects.theforeman.org/issues/11119
Mailing List
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1243571
Issue Tracking
Mitigation
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:theforeman:foreman:1.1-1:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.2.0:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.2.0:rc1:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.2.0:rc2:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.2.0:rc3:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.2.1:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.2.2:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.2.3:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.3.0:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.3.0:rc1:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.3.0:rc2:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.3.0:rc3:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.3.0:rc4:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.3.1:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.3.2:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.4.0:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.4.0:rc1:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.4.0:rc2:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.4.1:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.4.2:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.4.3:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.4.4:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.4.5:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.5.0:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.5.1:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.5.2:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.5.3:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.6.0:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.6.0:rc1:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.6.0:rc2:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.6.1:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.7.0:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.7.0:rc1:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.7.0:rc2:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.7.1:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.7.2:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.7.3:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.7.4:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.7.5:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.8.0:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.8.0:rc1:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.8.0:rc2:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.8.0:rc3:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.8.1:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.8.2:*:*:*:*:*:*:*

cpe:2.3:a:theforeman:foreman:1.8.3:*:*:*:*:*:*:*

EPSS

Процентиль: 72%

0.01514

Низкий

8.1 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200

Связанные уязвимости

CVE-2015-5152

redhat

около 11 лет назад

CVE-2015-5152

CVSS3: 8.1

debian

около 9 лет назад

Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests ...

GHSA-f78j-3cq3-m6p4

CVSS3: 8.1

github

около 4 лет назад

EPSS

Процентиль: 72%

0.01514

Низкий

8.1 High

CVSS3

4.3 Medium

CVSS2

Дефекты

CWE-200