CVE-2013-2113 The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing...
MediumCVSS 6.0
EPSS 20.9%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat openstack | = 3.0 | No fix listed |
| theforeman foreman | <= 1.2.0 | No fix listed |
| theforeman foreman | = 1.1 | No fix listed |
References
- projects.theforeman.org
- RHSA-2013:0995 vendor-advisory
- bugzilla.redhat.com
- groups.google.com