Theforeman: >> Foreman >> 1.5.2 Security Vulnerabilities
Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.
CVSS Score
5.0
EPSS Score
0.002
Published
2015-08-14
Cross-site scripting (XSS) vulnerability in the template preview function in Foreman before 1.6.1 allows remote attackers to inject arbitrary web script or HTML via a crafted provisioning template.
CVSS Score
4.3
EPSS Score
0.003
Published
2015-07-06
Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.
CVSS Score
7.5
EPSS Score
0.004
Published
2015-03-09
Page 4