CVE-2016-4451

Vulnerability

The Organization and Locations APIs in Foreman before version 1.11.3 and 1.12.x before 1.12.0-RC1 allow remote authenticated users with unlimited filters to bypass organization and location restrictions. This enables reading or modifying data for an arbitrary organization by leveraging knowledge of the organization's ID [1][2].

Exploitation

An attacker must be a remote authenticated user with unlimited filters. They need to know the ID of the target organization. No additional privileges are required beyond authentication. The attacker can then use the API to access or modify data for that organization, bypassing intended restrictions [1][2].

Impact

Successful exploitation allows the attacker to read or modify data for an arbitrary organization. This can lead to unauthorized information disclosure or data tampering, compromising the confidentiality and integrity of the affected organization's data within the Foreman instance [1][2].

Mitigation

The vulnerability is fixed in Foreman 1.11.3 and 1.12.0-RC1. Red Hat Satellite 6.3 includes the fix. Users should upgrade to these versions. No workaround is mentioned. The issue is listed on the Foreman security advisories page [1][2].