Description
Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | capsule-installer +1 | 2.3.22-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | foreman +1 | 1.7.2.49-1.el6_6sat | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | foreman-discovery-image | 1:3.0.5-3.el7sat | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | foreman-proxy | 1.7.2.7-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | gofer +3 | 2.6.8-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | katello-agent | 2.2.6-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | python-nectar | 1.3.4-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | python-qpid | 0.30-7.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | qpid-dispatch +2 | 0.4-11.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | qpid-proton +2 | 0.9-11.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | rubygem-hammer_cli_foreman_docker +1 | 0.0.3.10-1.el7sat | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_discovery | 1.0.3-2.el6 | RHSA-2015:2622 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_discovery_image | 1.0.5-3.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | foreman +7 | 1.7.2.49-1.el6_6sat | RHSA-2015:2622 |
| Red Hat Satellite 6 | foreman-discovery-image | 1:3.0.5-3.el7sat | RHSA-2015:2622 |
| Red Hat Satellite 6 | foreman-proxy | 1.7.2.7-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | gofer +3 | 2.6.8-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | katello-agent | 2.2.6-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | katello-installer +1 | 2.3.22-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | python-nectar | 1.3.4-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | python-qpid | 0.30-7.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | qpid-dispatch +3 | 0.4-11.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | qpid-proton +2 | 0.9-11.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | ruby193-rubygem-foreman-redhat_access | 0.2.4-1.el6_6sat | RHSA-2015:2622 |
| Red Hat Satellite 6 | ruby193-rubygem-foreman_bootdisk | 4.0.2.14-1.el6_6sat | RHSA-2015:2622 |
| Red Hat Satellite 6 | ruby193-rubygem-foreman_discovery | 2.0.0.23-1.el6_6sat | RHSA-2015:2622 |
| Red Hat Satellite 6 | ruby193-rubygem-katello | 2.2.0.77-1.el6_6sat | RHSA-2015:2622 |
| Red Hat Satellite 6 | ruby193-rubygem-redhat_access_lib | 0.0.6-1.el6_6sat | RHSA-2015:2622 |
| Red Hat Satellite 6 | rubygem-hammer_cli_foreman_docker +1 | 0.0.3.10-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | rubygem-newt | 0.9.6-1.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | rubygem-smart_proxy_discovery | 1.0.3-2.el6 | RHSA-2015:2622 |
| Red Hat Satellite 6 | rubygem-smart_proxy_discovery_image | 1.0.5-3.el6 | RHSA-2015:2622 |
Advisories 1
- RHSA-2015:2622 Red Hat Security Advisory: Satellite 6.1.5 bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026