CVE-2016-5390: Theforeman Foreman

Medium severity, CVSS 5.3. EPSS: 1.3% chance of exploitation in the next 30 days.

Foreman before 1.11.4 and 1.12.x before 1.12.1 allow remote authenticated users with the view_hosts permission containing a filter to obtain sensitive network interface information via a request to API routes beneath "hosts," as demonstrated by a GET request to api/v2/hosts/secrethost/interfaces.

Affected products

• Theforeman Foreman: from 1.11.0, before 1.11.4 (fixed in 1.11.4); from 1.12.0, before 1.12.1 (fixed in 1.12.1)

Published 2016-08-19. Last modified 2026-06-17.