Vulnerability-Lookup

CVE-2016-2100 (GCVE-0-2016-2100)

Vulnerability from cvelistv5 – Published: 2016-05-20 14:00 – Updated: 2024-08-05 23:17

Summary

Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.

Severity

5.4 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

CWE

Assigner

redhat redhat root

References

4 references

URL	Tags
https://access.redhat.com/errata/RHBA-2016:1500	vendor-advisoryx_refsource_REDHAT
http://www.openwall.com/lists/oss-security/2016/03/31/2	mailing-listx_refsource_MLIST
http://projects.theforeman.org/issues/13828	x_refsource_CONFIRM
http://theforeman.org/security.html#2016-2100	x_refsource_CONFIRM

Date Public

2016-02-22 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T23:17:50.599Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHBA-2016:1500",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHBA-2016:1500"
          },
          {
            "name": "[oss-security] 20160331 CVE-2016-2100: Foreman private bookmarks can be viewed and edited",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://projects.theforeman.org/issues/13828"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://theforeman.org/security.html#2016-2100"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2016-02-22T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-01-04T19:57:01.000Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHBA-2016:1500",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHBA-2016:1500"
        },
        {
          "name": "[oss-security] 20160331 CVE-2016-2100: Foreman private bookmarks can be viewed and edited",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://projects.theforeman.org/issues/13828"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://theforeman.org/security.html#2016-2100"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2016-2100",
    "datePublished": "2016-05-20T14:00:00.000Z",
    "dateReserved": "2016-01-29T00:00:00.000Z",
    "dateUpdated": "2024-08-05T23:17:50.599Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2016-2100",
      "date": "2026-09-24",
      "epss": "0.01172",
      "percentile": "0.66072"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "60DDCD5B-A866-4BC3-9A5C-063716D11A81",
                  "versionEndIncluding": "1.10.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        },
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D4197DE0-AEB1-41CA-9264-22C29CCD7102",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*",
                  "matchCriteriaId": "E058208D-14B4-4D86-9B5D-57383FC5D5ED",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission."
        },
        {
          "lang": "es",
          "value": "Foreman en versiones anteriores a 1.10.3 y 1.11.0 en versiones anteriores a 1.11.0-RC2 permite a usuarios remotos autenticados leer, modificar o borrar marcadores privados aprovechando el permiso (1) edit_bookmarks o (2) destroy_bookmarks."
        }
      ],
      "id": "CVE-2016-2100",
      "lastModified": "2024-11-21T02:47:48.337",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "PARTIAL",
              "baseScore": 6.5,
              "confidentialityImpact": "PARTIAL",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 6.4,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV30": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 5.4,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
              "version": "3.0"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 2.5,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2016-05-20T14:59:02.200",
      "references": [
        {
          "source": "secalert@redhat.com",
          "url": "http://projects.theforeman.org/issues/13828"
        },
        {
          "source": "secalert@redhat.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://theforeman.org/security.html#2016-2100"
        },
        {
          "source": "secalert@redhat.com",
          "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
        },
        {
          "source": "secalert@redhat.com",
          "url": "https://access.redhat.com/errata/RHBA-2016:1500"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://projects.theforeman.org/issues/13828"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "http://theforeman.org/security.html#2016-2100"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "url": "https://access.redhat.com/errata/RHBA-2016:1500"
        }
      ],
      "sourceIdentifier": "secalert@redhat.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-284"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "60DDCD5B-A866-4BC3-9A5C-063716D11A81",
                    "versionEndIncluding": "1.10.2",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          },
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D4197DE0-AEB1-41CA-9264-22C29CCD7102",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "E058208D-14B4-4D86-9B5D-57383FC5D5ED",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission."
          },
          {
            "lang": "es",
            "value": "Foreman en versiones anteriores a 1.10.3 y 1.11.0 en versiones anteriores a 1.11.0-RC2 permite a usuarios remotos autenticados leer, modificar o borrar marcadores privados aprovechando el permiso (1) edit_bookmarks o (2) destroy_bookmarks."
          }
        ],
        "id": "CVE-2016-2100",
        "lastModified": "2026-05-06T22:30:45.220",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "PARTIAL",
                "baseScore": 6.5,
                "confidentialityImpact": "PARTIAL",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 6.4,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV30": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 5.4,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
                "version": "3.0"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 2.5,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2016-05-20T14:59:02.200",
        "references": [
          {
            "source": "secalert@redhat.com",
            "url": "http://projects.theforeman.org/issues/13828"
          },
          {
            "source": "secalert@redhat.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://theforeman.org/security.html#2016-2100"
          },
          {
            "source": "secalert@redhat.com",
            "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
          },
          {
            "source": "secalert@redhat.com",
            "url": "https://access.redhat.com/errata/RHBA-2016:1500"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://projects.theforeman.org/issues/13828"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "http://theforeman.org/security.html#2016-2100"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://access.redhat.com/errata/RHBA-2016:1500"
          }
        ],
        "sourceIdentifier": "secalert@redhat.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-284"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T11:26:15+00:00",
      "cve": "CVE-2016-2100",
      "id": "CVE-2016-2100",
      "initial_release_date": "2016-01-01T00:00:00+00:00",
      "product_status:fixed": "1092",
      "product_status:under_investigation": "3",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "foreman: Unprivileged user can access private bookmarks of other users",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2016/cve-2016-2100.json",
      "version": "3"
    }
  }
}

CNVD-2016-01982

Vulnerability from cnvd - Published: 2016-04-05

Title

Foreman Bookmark Access安全绕过漏洞

Description

Foreman是一套用于物理和虚拟服务器中的生命周期管理工具。 Foreman处理与Administer -> Bookmarks功能相关的书签时存在错误，远程攻击者可利用该漏洞绕过安全限制，访问其他用户的受限制的书签。

Severity

中

Patch Name

Foreman Bookmark Access安全绕过漏洞的补丁

Patch Description

Foreman是一套用于物理和虚拟服务器中的生命周期管理工具。 Foreman处理与Administer -> Bookmarks功能相关的书签时存在错误，远程攻击者可利用该漏洞绕过安全限制，访问其他用户的受限制的书签。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

用户可参考如下厂商提供的安全补丁以修复该漏洞： http://theforeman.org/security.html#2016-2100

Reference

http://theforeman.org/security.html#2016-2100

Impacted products

Name
Foreman Foreman >=0.3

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2016-2100"
    }
  },
  "description": "Foreman\u662f\u4e00\u5957\u7528\u4e8e\u7269\u7406\u548c\u865a\u62df\u670d\u52a1\u5668\u4e2d\u7684\u751f\u547d\u5468\u671f\u7ba1\u7406\u5de5\u5177\u3002\r\n\r\nForeman\u5904\u7406\u4e0eAdminister -\u003e Bookmarks\u529f\u80fd\u76f8\u5173\u7684\u4e66\u7b7e\u65f6\u5b58\u5728\u9519\u8bef\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u8bbf\u95ee\u5176\u4ed6\u7528\u6237\u7684\u53d7\u9650\u5236\u7684\u4e66\u7b7e\u3002",
  "discovererName": "unknown",
  "formalWay": "\u7528\u6237\u53ef\u53c2\u8003\u5982\u4e0b\u5382\u5546\u63d0\u4f9b\u7684\u5b89\u5168\u8865\u4e01\u4ee5\u4fee\u590d\u8be5\u6f0f\u6d1e\uff1a\r\nhttp://theforeman.org/security.html#2016-2100",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2016-01982",
  "openTime": "2016-04-05",
  "patchDescription": "Foreman\u662f\u4e00\u5957\u7528\u4e8e\u7269\u7406\u548c\u865a\u62df\u670d\u52a1\u5668\u4e2d\u7684\u751f\u547d\u5468\u671f\u7ba1\u7406\u5de5\u5177\u3002\r\n\r\nForeman\u5904\u7406\u4e0eAdminister -\u003e Bookmarks\u529f\u80fd\u76f8\u5173\u7684\u4e66\u7b7e\u65f6\u5b58\u5728\u9519\u8bef\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u5b89\u5168\u9650\u5236\uff0c\u8bbf\u95ee\u5176\u4ed6\u7528\u6237\u7684\u53d7\u9650\u5236\u7684\u4e66\u7b7e\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Foreman Bookmark Access\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": "Foreman Foreman \u003e=0.3"
  },
  "referenceLink": "http://theforeman.org/security.html#2016-2100",
  "serverity": "\u4e2d",
  "submitTime": "2016-04-03",
  "title": "Foreman Bookmark Access\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e"
}

FKIE_CVE-2016-2100

Vulnerability from fkie_nvd - Published: 2016-05-20 14:59 - Updated: 2026-06-17 00:43

Severity

5.4 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Summary

References

URL	Tags
secalert@redhat.com	http://projects.theforeman.org/issues/13828
secalert@redhat.com	http://theforeman.org/security.html#2016-2100	Vendor Advisory
secalert@redhat.com	http://www.openwall.com/lists/oss-security/2016/03/31/2
secalert@redhat.com	https://access.redhat.com/errata/RHBA-2016:1500
af854a3a-2127-422b-91ae-364da2661108	http://projects.theforeman.org/issues/13828
af854a3a-2127-422b-91ae-364da2661108	http://theforeman.org/security.html#2016-2100	Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	http://www.openwall.com/lists/oss-security/2016/03/31/2
af854a3a-2127-422b-91ae-364da2661108	https://access.redhat.com/errata/RHBA-2016:1500

Impacted products

Vendor	Product	Version
theforeman	foreman	*
theforeman	foreman	1.11.0
theforeman	foreman	1.11.0

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "secalert@redhat.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "60DDCD5B-A866-4BC3-9A5C-063716D11A81",
              "versionEndIncluding": "1.10.2",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "D4197DE0-AEB1-41CA-9264-22C29CCD7102",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*",
              "matchCriteriaId": "E058208D-14B4-4D86-9B5D-57383FC5D5ED",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission."
    },
    {
      "lang": "es",
      "value": "Foreman en versiones anteriores a 1.10.3 y 1.11.0 en versiones anteriores a 1.11.0-RC2 permite a usuarios remotos autenticados leer, modificar o borrar marcadores privados aprovechando el permiso (1) edit_bookmarks o (2) destroy_bookmarks."
    }
  ],
  "id": "CVE-2016-2100",
  "lastModified": "2026-06-17T00:43:26.040",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2016-05-20T14:59:02.200",
  "references": [
    {
      "source": "secalert@redhat.com",
      "url": "http://projects.theforeman.org/issues/13828"
    },
    {
      "source": "secalert@redhat.com",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://theforeman.org/security.html#2016-2100"
    },
    {
      "source": "secalert@redhat.com",
      "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
    },
    {
      "source": "secalert@redhat.com",
      "url": "https://access.redhat.com/errata/RHBA-2016:1500"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://projects.theforeman.org/issues/13828"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://theforeman.org/security.html#2016-2100"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://access.redhat.com/errata/RHBA-2016:1500"
    }
  ],
  "sourceIdentifier": "secalert@redhat.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-96W5-W762-FPVR

Vulnerability from github – Published: 2022-05-14 03:57 – Updated: 2022-05-14 03:57

Details

Severity

5.4 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2016-2100"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2016-05-20T14:59:00Z",
    "severity": "MODERATE"
  },
  "details": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.",
  "id": "GHSA-96w5-w762-fpvr",
  "modified": "2022-05-14T03:57:53Z",
  "published": "2022-05-14T03:57:53Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2100"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHBA-2016:1500"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2016-2100"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1310675"
    },
    {
      "type": "WEB",
      "url": "http://projects.theforeman.org/issues/13828"
    },
    {
      "type": "WEB",
      "url": "http://theforeman.org/security.html#2016-2100"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GSD-2016-2100

Vulnerability from gsd - Updated: 2023-12-13 01:21

Details

Aliases

CVE-2016-2100

Aliases

CVE-2016-2100

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2016-2100",
    "description": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.",
    "id": "GSD-2016-2100",
    "references": [
      "https://access.redhat.com/errata/RHBA-2016:1500"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2016-2100"
      ],
      "details": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.",
      "id": "GSD-2016-2100",
      "modified": "2023-12-13T01:21:19.392356Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "secalert@redhat.com",
        "ID": "CVE-2016-2100",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "n/a",
                    "version": {
                      "version_data": [
                        {
                          "version_affected": "=",
                          "version_value": "n/a"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "n/a"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://access.redhat.com/errata/RHBA-2016:1500",
            "refsource": "MISC",
            "url": "https://access.redhat.com/errata/RHBA-2016:1500"
          },
          {
            "name": "http://projects.theforeman.org/issues/13828",
            "refsource": "MISC",
            "url": "http://projects.theforeman.org/issues/13828"
          },
          {
            "name": "http://theforeman.org/security.html#2016-2100",
            "refsource": "MISC",
            "url": "http://theforeman.org/security.html#2016-2100"
          },
          {
            "name": "http://www.openwall.com/lists/oss-security/2016/03/31/2",
            "refsource": "MISC",
            "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
          }
        ]
      }
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndIncluding": "1.10.2",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2016-2100"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-284"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://projects.theforeman.org/issues/13828",
              "refsource": "CONFIRM",
              "tags": [],
              "url": "http://projects.theforeman.org/issues/13828"
            },
            {
              "name": "http://theforeman.org/security.html#2016-2100",
              "refsource": "CONFIRM",
              "tags": [
                "Vendor Advisory"
              ],
              "url": "http://theforeman.org/security.html#2016-2100"
            },
            {
              "name": "[oss-security] 20160331 CVE-2016-2100: Foreman private bookmarks can be viewed and edited",
              "refsource": "MLIST",
              "tags": [],
              "url": "http://www.openwall.com/lists/oss-security/2016/03/31/2"
            },
            {
              "name": "RHBA-2016:1500",
              "refsource": "REDHAT",
              "tags": [],
              "url": "https://access.redhat.com/errata/RHBA-2016:1500"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
            "version": "2.0"
          },
          "exploitabilityScore": 8.0,
          "impactScore": 6.4,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.5
        }
      },
      "lastModifiedDate": "2023-02-13T04:50Z",
      "publishedDate": "2016-05-20T14:59Z"
    }
  }
}

RHBA-2016:1500

Vulnerability from csaf_redhat - Published: 2016-07-27 08:24 - Updated: 2026-06-28 12:20

Summary

Red Hat Bug Fix Advisory: Red Hat Satellite 6.2 Base Libraries

Severity

Moderate

Scope

6 vulnerabilities in this advisory, including CVE-2016-2100.

CVE-2016-2100

It was found that access to private bookmarks of users is not properly restricted in Foreman. This could allow an attacker to view the search terms used in these bookmarks which should be private.

5.5 ()


                
                  AV:N/AC:L/Au:S/C:P/I:P/A:N

Fixed: 1092 products

https://access.redhat.com/errata/RHBA-2016:1500

Open the full advisory

RHBA-2016_1500

Vulnerability from csaf_redhat - Published: 2016-07-27 08:24 - Updated: 2024-11-14 19:50

Summary

Red Hat Bug Fix Advisory: Red Hat Satellite 6.2 Base Libraries

Severity

Moderate

Scope

6 vulnerabilities in this advisory, including CVE-2016-2100.

CVE-2016-2100

It was found that access to private bookmarks of users is not properly restricted in Foreman. This could allow an attacker to view the search terms used in these bookmarks which should be private.

5.5 ()


                
                  AV:N/AC:L/Au:S/C:P/I:P/A:N

Fixed: 1092 products

https://access.redhat.com/errata/RHBA-2016:1500

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2016-2100 (GCVE-0-2016-2100)

CNVD-2016-01982

FKIE_CVE-2016-2100

GHSA-96W5-W762-FPVR

GSD-2016-2100

RHBA-2016:1500

RHBA-2016_1500

Tags

Sightings

Nomenclature

Related by attack behaviour