CVE-2016-4475

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-254

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://projects.theforeman.org/issues/15268Patch, Vendor Advisory
http://projects.theforeman.org/projects/foreman/repository/revisions/a30ab44ed6f140f1791afc51a1e448afc2ff28f9Patch, Vendor Advisory
http://www.securityfocus.com/bid/92125Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2016:1615
https://theforeman.org/security.html#2016-4475Vendor Advisory
http://projects.theforeman.org/issues/15268Patch, Vendor Advisory
http://projects.theforeman.org/projects/foreman/repository/revisions/a30ab44ed6f140f1791afc51a1e448afc2ff28f9Patch, Vendor Advisory
http://www.securityfocus.com/bid/92125Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2016:1615
https://theforeman.org/security.html#2016-4475Vendor Advisory

Timeline

Published: Aug 19, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-44767.5hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \n and \r characters in passphrase parameters, which allows rem CVE-2016-44777.8wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrar CVE-2016-44787.5Buffer overflow in the xmlrpc_char_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to CVE-2016-44808.4The guest_walk_tables function in arch/x86/mm/guest_walk.c in Xen 4.6.x and earlier does not properly handle the Page Size (PS) page table e CVE-2016-44826.2The proc_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, whic CVE-2016-44837.5The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-b CVE-2016-44846.8The Debian initrd script for the cryptsetup package 2:1.7.3-2 and earlier allows physically proximate attackers to gain shell access via man CVE-2016-44857.5The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows at CVE-2016-44863.3The rtnl_fill_link_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, whi CVE-2016-44875.5Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted CVE-2016-44885.5Use-after-free vulnerability in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash) via a crafted CVE-2016-44895.5Integer overflow in the gnu_special function in libiberty allows remote attackers to cause a denial of service (segmentation fault and crash