CVE-2019-10198

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-592 CWE-306

Affected software

Vendor	Product	Versions
The Foreman Project	foreman-tasks	0.15.7

References

https://access.redhat.com/errata/RHSA-2019:3172Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10198Issue Tracking, Patch, Third Party Advisory
https://projects.theforeman.org/issues/27275Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3172Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10198Issue Tracking, Patch, Third Party Advisory
https://projects.theforeman.org/issues/27275Third Party Advisory

Timeline

Published: Jul 31, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-101998.8It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use th CVE-2019-102007.2A flaw was discovered in OpenShift Container Platform 4 where, by default, users with access to create pods also have the ability to schedul CVE-2019-10200017.5yard before 0.9.20 allows path traversal.CVE-2019-10200027.5Pterodactyl before 0.7.14 with 2FA allows credential sniffing.CVE-2019-10200035.4invenio-records before 1.2.2 allows XSS.CVE-2019-10200047.5Tridactyl before 1.16.0 allows fake key events.CVE-2019-10200055.4invenio-communities before 1.0.0a20 allows XSS.CVE-2019-10200066.1invenio-app before 1.1.1 allows host header injection.CVE-2019-10200075.4Dependency-Track before 3.5.1 allows XSS.CVE-2019-10200086.1stacktable.js before 1.0.4 allows XSS.CVE-2019-10200097.5Fleet before 2.1.2 allows exposure of SMTP credentials.CVE-2019-10200106.1Misskey before 10.102.4 allows hijacking a user's token.