VYPR
← All advisories
Critical severity9.8NVD Advisory· Published Sep 4, 2024· Updated Jun 17, 2026

CVE-2024-7012

CVE-2024-7012

Description

An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on underscores in HTTP headers, allowing authentication through a malformed header. This flaw impacts all active Satellite deployments (6.13, 6.14 and 6.15) and could potentially enable unauthorized users to gain administrative access.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

5
  • Theforeman/Puppet Foremaninferred
  • Red Hat/Satellite4 versions
    cpe:2.3:a:redhat:satellite:6.13:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:redhat:satellite:6.13:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite:6.14:*:*:*:*:*:*:*
    • cpe:2.3:a:redhat:satellite:6.15:*:*:*:*:*:*:*
    • (no CPE)range: 6.13, 6.14, 6.15

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.