Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-6861

Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
redhat

Description

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

foreman

Default version status: unaffected

  • 0 to < 3.3affected

Red Hat Red Hat Satellite 6.12 for RHEL 8

Default version status: affected

  • 0:3.3.0.17-1.el8sat to < *unaffected

Red Hat Red Hat Satellite 6

Default version status: unaffected

Red Hat Red Hat Satellite 6

Default version status: unaffected

Red Hat Red Hat Satellite 6

Default version status: unaffected

References