CVE-2024-3716

MediumCVSS 6.2/10Last modified Jun 17, 2026

Description

A flaw was found in foreman-installer when puppet-candlepin is invoked cpdb with the --password parameter. This issue leaks the password in the process list and allows an attacker to take advantage and obtain the password.

Metrics

CVSS 3.1 6.2/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
—	—	—
Red Hat	Red Hat Satellite 6	—

References

https://access.redhat.com/security/cve/CVE-2024-3716Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2274755Issue Tracking, Third Party Advisory
https://access.redhat.com/security/cve/CVE-2024-3716Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2274755Issue Tracking, Third Party Advisory

Timeline

Published: Jun 5, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-371604.8Formwork is a flat file-based Content Management System (CMS). An attackers (requires administrator privilege) to execute arbitrary web scri CVE-2024-371616.1MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting CVE-2024-371625.3zsa is a library for building typesafe server actions in Next.js. All users are impacted. The zsa application transfers the parse error stac CVE-2024-371637.5SkyScrape is a GUI Dashboard for AWS Infrastructure and Managing Resources and Usage Costs. SkyScrape's API requests are currently unsecure CVE-2024-371648.5Computer Vision Annotation Tool (CVAT) is an interactive video and image annotation tool for computer vision. CVAT allows users to supply cu CVE-2024-371656.1Discourse is an open source discussion platform. Prior to 3.2.3 and 3.3.0.beta3, improperly sanitized Onebox data could lead to an XSS vulne CVE-2024-371668.9ghtml is software that uses tagged templates for template engine functionality. It is possible to introduce user-controlled JavaScript code CVE-2024-371674.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. Users are able to see backlog items that th CVE-2024-371685.3@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to versions 1.10.9, 1.9.15, and 1.8 CVE-2024-371695.3@jmondi/url-to-png is a self-hosted URL to PNG utility. Versions prior to 2.0.3 are vulnerable to arbitrary file read if a threat actor uses CVE-2024-37177.5The Drag and Drop Multiple File Upload – Contact Form 7 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions CVE-2024-371715.0SAP Transportation Management (Collaboration Portal) allows an attacker with non-administrative privileges to send a crafted request from a