| Vulnerability Name: | CVE-2013-2113 (CCN-85321) | ||||||||
| Assigned: | 2013-06-07 | ||||||||
| Published: | 2013-06-07 | ||||||||
| Updated: | 2023-02-13 | ||||||||
| Summary: | Foreman could allow a remote authenticated attacker to bypass security restrictions, caused by the failure to properly verify privileges when assigning user roles. An attacker could exploit this vulnerability to enable the admin flag. | ||||||||
| CVSS v3 Severity: | 3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N)
| ||||||||
| CVSS v2 Severity: | 6.0 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P) 4.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P/E:F/RL:OF/RC:UR)
3.1 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N/E:F/RL:OF/RC:UR)
| ||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||
| References: | Source: MITRE Type: CNA CVE-2013-2113 Source: CCN Type: Foreman Bug #2630 Users with create/edit user permissions can escalate to admin Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: SA53981 Foreman Security Bypass Security Issue and Code Execution Vulnerability Source: CCN Type: Foreman Web Site Foreman Source: CCN Type: BID-60835 Foreman 'users_controller.rb' Remote Privilege Escalation Vulnerability Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: XF Type: UNKNOWN foreman-cve20132113-sec-bypass(85321) Source: secalert@redhat.com Type: UNKNOWN secalert@redhat.com Source: CCN Type: Packet Storm Security [08-21-2013] Foreman (Red Hat OpenStack/Satellite) users/create Mass Assignment Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [08-22-2013] | ||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||
| BACK | |||||||||