CVE-2021-3494

Katalog CVE

CVSS 5.9 · Medium EPSS 0,37%

Kerentanan Cleartext Transmission of Sensitive Information pada theforeman foreman. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.

Rincian

Terbit di NVD

26 April 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-319: Cleartext Transmission of Sensitive Information

EPSS (30 hari)

0,37% peluang dieksploitasi; lebih tinggi dari 28,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1948005 issue tracking · advisory pihak ketiga