Medium severity5.3NVD Advisory· Published Aug 19, 2016· Updated May 6, 2026

CVE-2016-5390

Description

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.

Affected products

Theforeman/Foreman
cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*
Range: >=1.11.0,<1.11.4

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

projects.theforeman.org/issues/15653nvdPatchVendor Advisory
www.securityfocus.com/bid/91770nvdThird Party AdvisoryVDB Entry
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party AdvisoryVDB Entry
theforeman.org/security.htmlnvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000