CVE-2016-4451

MediumCVSS 5.0/10Last modified Jun 17, 2026

Description

The (1) Organization and (2) Locations APIs in Foreman before 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions and read or modify data for an arbitrary organization by leveraging knowledge of the id of that organization.

Metrics

CVSS 3.0 5.0/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-254

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2016
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2016

CVE-2016-44534.4The vmsvga_fifo_run function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite CVE-2016-44546.0The vmsvga_fifo_read_raw function in hw/display/vmware_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory inCVE-2016-44553.3The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-managCVE-2016-44567.5The "GNUTLS_KEYLOGFILE" environment variable in gnutls 3.4.12 allows remote attackers to overwrite and corrupt arbitrary files in the filesyCVE-2016-44577.5CloudForms Management Engine before 5.8 includes a default SSL/TLS certificate.CVE-2016-44597.5Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9.CVE-2016-44609.8Apache Pony Mail 0.6c through 0.8b allows remote attackers to bypass authentication.CVE-2016-44618.8Apache Struts 2.x before 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, aka forced doubleCVE-2016-44628.8By manipulating the URL parameter externalLoginKey, a malicious, logged in user could pass valid Freemarker directives to the Template EnginCVE-2016-44637.5Stack-based buffer overflow in Apache Xerces-C++ before 3.1.4 allows context-dependent attackers to cause a denial of service via a deeply nCVE-2016-44649.8The application plugins in Apache CXF Fediz 1.2.x before 1.2.3 and 1.3.x before 1.3.1 do not match SAML AudienceRestriction values against cCVE-2016-44655.3The URLValidator class in Apache Struts 2 2.3.20 through 2.3.28.1 and 2.5.x before 2.5.1 allows remote attackers to cause a denial of servic
CVE-2016-4451: Medium severity, CVSS 5.0 | Vulnix