GCVE - cpe:2.3:a:theforeman:foreman:1.15.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:theforeman:foreman:1.15.0:*:*:*:*:*:*:*

part: a version: 1.15.0 update: *

Vendor	Theforeman (`760bf134-312a-50ab-8452-1d7485d10f9b`)
Product	Foreman (`a88a3ac5-9a3c-5a4c-91ec-c5eca465eab6`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/ruby-foreman`	purl2cpe	2026-06-01 10:15:04.573555
`pkg:deb/ubuntu/ruby-foreman`	purl2cpe	2026-06-01 10:15:04.573557
`pkg:gem/foreman`	purl2cpe	2026-06-01 10:15:04.573559
`pkg:github/theforeman/foreman`	purl2cpe	2026-06-01 10:15:04.573560
`pkg:rpm/opensuse/rubygem-foreman`	purl2cpe	2026-06-01 10:15:04.573562

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2017-7505`	vulnerable	2026-06-08 05:09:56.279451	Details available Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigned to some organization(s) can do all operations granted by these permissions on all administrator user object outside of their scope, such as editing global admin accounts including changing their passwords. Published: 2017-05-26T16:00:00.000Z Updated: 2024-08-05T16:04:11.828Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/98607 http://projects.theforeman.org/issues/19612 https://github.com/theforeman/foreman/pull/4545	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-7078`	vulnerable	2026-06-08 05:08:11.714110	Details available MEDIUM (4.3) foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion. Published: 2018-09-10T15:00:00.000Z Updated: 2024-08-06T01:50:47.463Z Open on db.gcve.eu Reference links https://github.com/theforeman/foreman/commit/5f606e11cf39719bf62f8b1f3396861b32387905 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7078 http://www.securityfocus.com/bid/96385 https://theforeman.org/security.html#2016-7078 https://projects.theforeman.org/issues/16982	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-5282`	vulnerable	2026-06-08 05:06:49.442006	Details available Cross-site scripting (XSS) vulnerability in Foreman 1.7.0 and after. Published: 2017-09-25T17:00:00.000Z Updated: 2024-08-06T06:41:09.516Z Open on db.gcve.eu Reference links https://github.com/theforeman/foreman/commit/4f3555b217be8723e8045f9816d147b5f684ec57 https://bugzilla.redhat.com/show_bug.cgi?id=1264221 http://www.openwall.com/lists/oss-security/2015/09/21/3 https://theforeman.org/security.html#2015-5282 http://projects.theforeman.org/issues/11859	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.