CVE-2015-5233: Red Hat Satellite

Medium severity, CVSS 4.2. EPSS: 1.2% chance of exploitation in the next 30 days.

Foreman before 1.8.4 and 1.9.x before 1.9.1 do not properly apply view_hosts permissions, which allows (1) remote authenticated users with the view_reports permission to read reports from arbitrary hosts or (2) remote authenticated users with the destroy_reports permission to delete reports from arbitrary hosts via direct access to the (a) individual report show/delete pages or (b) APIs.

Affected products

• Red Hat Satellite: version 6.1 only
• Theforeman Foreman: up to and including 1.8.3; version 1.9.0 only

Published 2016-04-11. Last modified 2026-06-17.