A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.
References
Link | Resource |
---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=1948005 | Issue Tracking Third Party Advisory |
https://bugzilla.redhat.com/show_bug.cgi?id=1948005 | Issue Tracking Third Party Advisory |
Configurations
History
21 Nov 2024, 06:21
Type | Values Removed | Values Added |
---|---|---|
References | () https://bugzilla.redhat.com/show_bug.cgi?id=1948005 - Issue Tracking, Third Party Advisory |
Information
Published : 2021-04-26 15:15
Updated : 2024-11-21 06:21
NVD link : CVE-2021-3494
Mitre link : CVE-2021-3494
CVE.ORG link : CVE-2021-3494
JSON object : View
Products Affected
theforeman
- foreman
CWE
CWE-319
Cleartext Transmission of Sensitive Information