CVE-2013-2113
Fixed in a distro release EPSS 21%
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
Products: redhat openstack, theforeman foreman
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat openstack 3 | ruby193-foreman | 0:1.1.10009-3.el6ost |
| Red Hat openstack 3 | ruby193-foreman-mysql | 0:1.1.10009-3.el6ost |
| Red Hat openstack 3 | ruby193-foreman-proxy | 0:1.1.10001-4.el6ost |
| Red Hat openstack 3 | ruby193-openstack-foreman-installer | 0:0.0.18-1.el6ost |
| Red Hat openstack 3 | ruby193-openstack-foreman-installer-debuginfo | 0:0.0.18-1.el6ost |
| Red Hat openstack 3 | ruby193-rubygem-ancestry | 0:1.3.0-5.el6ost |
| Red Hat openstack 3 | ruby193-rubygem-ancestry-doc | 0:1.3.0-5.el6ost |
| Red Hat openstack 3 | ruby193-rubygem-fog | 0:1.10.1-11.el6ost |
| Red Hat openstack 3 | ruby193-rubygem-fog-doc | 0:1.10.1-11.el6ost |
| Red Hat openstack 3 | ruby193-rubygem-mysql | 0:2.8.1-4.el6ost |
| Red Hat openstack 3 | ruby193-rubygem-mysql-debuginfo | 0:2.8.1-4.el6ost |
| Red Hat openstack 3 | ruby193-rubygem-safemode | 0:1.2.0-9.el6ost |
| Red Hat openstack 3 | ruby193-rubygem-safemode-doc | 0:1.2.0-9.el6ost |