CVE-2015-3155: Theforeman Foreman

Medium severity, CVSS 5.0. EPSS: 2.2% chance of exploitation in the next 30 days.

Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.

Affected products

• Theforeman Foreman: up to and including 1.8.0

Published 2015-08-14. Last modified 2026-06-17.