#VU10762 Information disclosure in Red Hat Satellite - CVE-2017-2672

Vulnerability identifier: #VU10762

Vulnerability risk: Low

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-2672

CWE-ID: CWE-312

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Red Hat Satellite
Server applications / Other server solutions

Vendor: Red Hat Inc.

Description
The vulnerability allows a remote attacker to obtain potentially sensitive information.

The weakness exists in the foreman's logging due to improper security restrictions during the adding or registering of images. A remote attacker with access to the foreman log file can view passwords for provisioned systems in the log file that allow to access those systems.

Mitigation
Update to version 6.3.

Vulnerable software versions

Red Hat Satellite: 6

---

External links
https://access.redhat.com/security/cve/cve-2017-2672

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.