Cloudanix VulnDB

CVE-2013-2113

None

CVSS

—

EPSS

20.9%

Published

Jul 31, 2013

CISA due date

—

The record

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.

Affected packages

Ecosystem Package Introduced Fixed
Red Hat:openstack:3::el6 ruby193-foreman 0 0:1.1.10009-3.el6ost
Red Hat:openstack:3::el6 ruby193-foreman-mysql 0 0:1.1.10009-3.el6ost
Red Hat:openstack:3::el6 ruby193-foreman-proxy 0 0:1.1.10001-4.el6ost
Red Hat:openstack:3::el6 ruby193-openstack-foreman-installer 0 0:0.0.18-1.el6ost
Red Hat:openstack:3::el6 ruby193-openstack-foreman-installer-debuginfo 0 0:0.0.18-1.el6ost
Red Hat:openstack:3::el6 ruby193-rubygem-ancestry 0 0:1.3.0-5.el6ost
Red Hat:openstack:3::el6 ruby193-rubygem-ancestry-doc 0 0:1.3.0-5.el6ost
Red Hat:openstack:3::el6 ruby193-rubygem-fog 0 0:1.10.1-11.el6ost
Red Hat:openstack:3::el6 ruby193-rubygem-fog-doc 0 0:1.10.1-11.el6ost
Red Hat:openstack:3::el6 ruby193-rubygem-mysql 0 0:2.8.1-4.el6ost
Red Hat:openstack:3::el6 ruby193-rubygem-mysql-debuginfo 0 0:2.8.1-4.el6ost
Red Hat:openstack:3::el6 ruby193-rubygem-safemode 0 0:1.2.0-9.el6ost
Red Hat:openstack:3::el6 ruby193-rubygem-safemode-doc 0 0:1.2.0-9.el6ost

Related vulnerabilities