CVE-2019-10198
An authentication bypass vulnerability was discovered in foreman-tasks before 0.15.7. Previously, commit tasks were searched through find_resource, which performed authorization checks. After the change to Foreman, an unauthenticated user can view the details of a task through the web UI or API, if they can discover or guess the UUID of the task.
Scoring
- Severity
- MEDIUM
- CVSS base score
- 6.5
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS probability
- 1.42%
- CWE
- CWE-592
- Published
- 2019-07-31
- Last modified
- 2026-03-14
Affected products
- The Foreman Project foreman-tasks
Weakness type
Related vulnerabilities
- CVE-2026-43512 — Apache Tomcat: Digest authenticator will authenticate any unknown user
- CVE-2023-30971 — Gaia unauthenticated endpoints
- CVE-2019-14843 — A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests...
- CVE-2019-14910 — A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation...
- CVE-2019-14909 — A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP...
- CVE-2019-10201 — It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message...
- CVE-2019-3899 — It was found that default configuration of Heketi does not require any authentication potentially...
- CVE-2014-5432 — Baxter SIGMA Spectrum Infusion System version 6.05 (model 35700BAX) with wireless battery module...