Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2025-9572

Опубликовано: 27 фев. 2026
Источник: nvd
CVSS3: 5
CVSS3: 6.5
EPSS Низкий

Описание

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*
Версия от 1.22.0 (включая) до 3.16.2 (исключая)
Конфигурация 2

Одно из

cpe:2.3:a:redhat:satellite:6.15:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.16:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.17:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite:6.18:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite_capsule:6.15:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite_capsule:6.16:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite_capsule:6.17:*:*:*:*:*:*:*
cpe:2.3:a:redhat:satellite_capsule:6.18:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*

EPSS

Процентиль: 1%
0.0001
Низкий

5 Medium

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-863
CWE-863

Связанные уязвимости

CVSS3: 5
ubuntu
около 1 месяца назад

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

CVSS3: 5
redhat
7 месяцев назад

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

CVSS3: 5
debian
около 1 месяца назад

n authorization flaw in Foreman's GraphQL API allows low-privileged us ...

CVSS3: 5
github
около 1 месяца назад

n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assigned permissions. Unlike the REST API, which correctly enforces access controls, the GraphQL endpoint does not apply proper filtering, leading to an authorization bypass.

EPSS

Процентиль: 1%
0.0001
Низкий

5 Medium

CVSS3

6.5 Medium

CVSS3

Дефекты

CWE-863
CWE-863