Every CVE Search/ Get API key

CVE-2016-4475

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1...

8.8 HighFix available

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

2.67%Up 1.5 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 8.8

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

Record
CVE-2016-4475
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-254
Updated
2026-11-02
CVE List No score

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

Record
CVE-2016-4475
Updated
2026-11-02
EUVDEUVD-2016-5462 No score

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

Record
EUVD-2016-5462
Updated
2026-11-03
GitHub AdvisoriesGHSA-8887-4wpv-8chr 8.8

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1...

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

Record
GHSA-8887-4wpv-8chr
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

The (1) Organization and (2) Locations APIs and UIs in Foreman before 1.11.4 and 1.12.x before 1.12.0-RC3 allow remote authenticated users to bypass organization and location restrictions and (a) read, (b) edit, or (c) delete arbitrary organizations or locations via unspecified vectors.

Record
CVE-2016-4475
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
foreman
Red Hat:satellite_capsule:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-debug
Red Hat:satellite_capsule:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-installer
Red Hat:satellite_capsule:6.1::el6
 before 1:1.11.0.10-1.el6sat
1:1.11.0.10-1.el6sat
foreman-proxy
Red Hat:satellite_capsule:6.1::el6
 before 0:1.11.0.5-1.el6sat
0:1.11.0.5-1.el6sat
pulp
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
pulp-admin-client
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
pulp-nodes-child
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
pulp-nodes-common
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
pulp-nodes-parent
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
pulp-selinux
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
Show 99 moreShow less
Affected packages
PackageAffectedFixed
pulp-server
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-agent-lib
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-bindings
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-client-lib
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-common
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-oid_validation
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-repoauth
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-streamer
Red Hat:satellite_capsule:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
satellite
Red Hat:satellite_capsule:6.1::el6
 before 0:6.2.1-1.2.el6sat
0:6.2.1-1.2.el6sat
satellite-capsule
Red Hat:satellite_capsule:6.1::el6
 before 0:6.2.1-1.2.el6sat
0:6.2.1-1.2.el6sat
satellite-debug-tools
Red Hat:satellite_capsule:6.1::el6
 before 0:6.2.1-1.2.el6sat
0:6.2.1-1.2.el6sat
foreman
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-compute
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-debug
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-ec2
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-gce
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-installer
Red Hat:satellite:6.1::el6
 before 1:1.11.0.10-1.el6sat
1:1.11.0.10-1.el6sat
foreman-libvirt
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-openstack
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-ovirt
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-postgresql
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-proxy
Red Hat:satellite:6.1::el6
 before 0:1.11.0.5-1.el6sat
0:1.11.0.5-1.el6sat
foreman-rackspace
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
foreman-vmware
Red Hat:satellite:6.1::el6
 before 0:1.11.0.51-1.el6sat
0:1.11.0.51-1.el6sat
pulp
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
pulp-admin-client
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
pulp-selinux
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
pulp-server
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-agent-lib
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-bindings
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-client-lib
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-common
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-oid_validation
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-repoauth
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
python-pulp-streamer
Red Hat:satellite:6.1::el6
 before 0:2.8.3.4-1.el6sat
0:2.8.3.4-1.el6sat
satellite
Red Hat:satellite:6.1::el6
 before 0:6.2.1-1.2.el6sat
0:6.2.1-1.2.el6sat
satellite-capsule
Red Hat:satellite:6.1::el6
 before 0:6.2.1-1.2.el6sat
0:6.2.1-1.2.el6sat
satellite-cli
Red Hat:satellite:6.1::el6
 before 0:6.2.1-1.2.el6sat
0:6.2.1-1.2.el6sat
satellite-debug-tools
Red Hat:satellite:6.1::el6
 before 0:6.2.1-1.2.el6sat
0:6.2.1-1.2.el6sat
tfm-rubygem-foreman_discovery
Red Hat:satellite:6.1::el6
 before 0:5.0.0.9-1.el6sat
0:5.0.0.9-1.el6sat
tfm-rubygem-hammer_cli_foreman_admin
Red Hat:satellite:6.1::el6
 before 0:0.0.5-1.el6sat
0:0.0.5-1.el6sat
tfm-rubygem-hammer_cli_katello
Red Hat:satellite:6.1::el6
 before 0:0.0.22.25-1.el6sat
0:0.0.22.25-1.el6sat
tfm-rubygem-katello
Red Hat:satellite:6.1::el6
 before 0:3.0.0.70-1.el6sat
0:3.0.0.70-1.el6sat
tfm-rubygem-ovirt_provision_plugin
Red Hat:satellite:6.1::el6
 before 0:1.0.2-1.el6sat
0:1.0.2-1.el6sat
foreman
Red Hat:satellite_capsule:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-debug
Red Hat:satellite_capsule:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-installer
Red Hat:satellite_capsule:6.2::el7
 before 1:1.11.0.10-1.el7sat
1:1.11.0.10-1.el7sat
foreman-proxy
Red Hat:satellite_capsule:6.2::el7
 before 0:1.11.0.5-1.el7sat
0:1.11.0.5-1.el7sat
pulp
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-admin-client
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-nodes-child
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-nodes-common
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-nodes-parent
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-selinux
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-server
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-agent-lib
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-bindings
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-client-lib
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-common
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-oid_validation
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-repoauth
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-streamer
Red Hat:satellite_capsule:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
satellite
Red Hat:satellite_capsule:6.2::el7
 before 0:6.2.1-1.2.el7sat
0:6.2.1-1.2.el7sat
satellite-capsule
Red Hat:satellite_capsule:6.2::el7
 before 0:6.2.1-1.2.el7sat
0:6.2.1-1.2.el7sat
satellite-debug-tools
Red Hat:satellite_capsule:6.2::el7
 before 0:6.2.1-1.2.el7sat
0:6.2.1-1.2.el7sat
foreman
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-compute
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-debug
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-ec2
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-gce
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-installer
Red Hat:satellite:6.2::el7
 before 1:1.11.0.10-1.el7sat
1:1.11.0.10-1.el7sat
foreman-libvirt
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-openstack
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-ovirt
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-postgresql
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-proxy
Red Hat:satellite:6.2::el7
 before 0:1.11.0.5-1.el7sat
0:1.11.0.5-1.el7sat
foreman-rackspace
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
foreman-vmware
Red Hat:satellite:6.2::el7
 before 0:1.11.0.51-1.el7sat
0:1.11.0.51-1.el7sat
pulp
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-admin-client
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-selinux
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
pulp-server
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-agent-lib
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-bindings
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-client-lib
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-common
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-oid_validation
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-repoauth
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
python-pulp-streamer
Red Hat:satellite:6.2::el7
 before 0:2.8.3.4-1.el7sat
0:2.8.3.4-1.el7sat
satellite
Red Hat:satellite:6.2::el7
 before 0:6.2.1-1.2.el7sat
0:6.2.1-1.2.el7sat
satellite-capsule
Red Hat:satellite:6.2::el7
 before 0:6.2.1-1.2.el7sat
0:6.2.1-1.2.el7sat
satellite-cli
Red Hat:satellite:6.2::el7
 before 0:6.2.1-1.2.el7sat
0:6.2.1-1.2.el7sat
satellite-debug-tools
Red Hat:satellite:6.2::el7
 before 0:6.2.1-1.2.el7sat
0:6.2.1-1.2.el7sat
tfm-rubygem-foreman_discovery
Red Hat:satellite:6.2::el7
 before 0:5.0.0.9-1.el7sat
0:5.0.0.9-1.el7sat
tfm-rubygem-hammer_cli_foreman_admin
Red Hat:satellite:6.2::el7
 before 0:0.0.5-1.el7sat
0:0.0.5-1.el7sat
tfm-rubygem-hammer_cli_katello
Red Hat:satellite:6.2::el7
 before 0:0.0.22.25-1.el7sat
0:0.0.22.25-1.el7sat
tfm-rubygem-katello
Red Hat:satellite:6.2::el7
 before 0:3.0.0.70-1.el7sat
0:3.0.0.70-1.el7sat
tfm-rubygem-katello_ostree
Red Hat:satellite:6.2::el7
 before 0:3.0.0.70-1.el7sat
0:3.0.0.70-1.el7sat
tfm-rubygem-ovirt_provision_plugin
Red Hat:satellite:6.2::el7
 before 0:1.0.2-1.el7sat
0:1.0.2-1.el7sat

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-4475 is a high vulnerability (CVSS 8.8) in Theforeman Foreman, published August 19, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.67%, the 85th percentile. Fixed in foreman 0:1.11.0.51-1.el6sat.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open