CVE-2013-2113

2013-07-3113:20:25

CWE-264

redhat

web.nvd.nist.gov

foreman

privilege escalation

cve-2013-2113

nvd

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.7

Confidence

Low

EPSS

0.105

Percentile

95.1%

JSON

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.

Affected configurations

Nvd

Node

redhatopenstackMatch3.0

theforemanforemanRange≤1.2.0rc1

theforemanforemanMatch1.1

VendorProductVersionCPE
redhatopenstack3.0cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*
theforemanforeman*cpe:2.3:a:theforeman:foreman:*:rc1:*:*:*:*:*:*
theforemanforeman1.1cpe:2.3:a:theforeman:foreman:1.1:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	openstack	3.0	cpe:2.3:a:redhat:openstack:3.0:::::::*
theforeman	foreman	*	cpe:2.3:a:theforeman:foreman::rc1::::::*
theforeman	foreman	1.1	cpe:2.3:a:theforeman:foreman:1.1:::::::*