Every CVE Search/ Get API key

CVE-2024-6861

Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

7.5 High

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.67%Up 0.6 points since Nov 7, 2024
90%50%10%1%

What each source reports

CVE List Score used 7.5

Foreman: foreman: oauth secret exposure via unauthenticated access to the graphql api

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Record
CVE-2024-6861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
EUVDEUVD-2024-47859 7.5

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Record
EUVD-2024-47859
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-q5h7-2qmh-rxhr 7.5

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the...

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Record
GHSA-q5h7-2qmh-rxhr
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
NVD 7.5

A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product's API.

Record
CVE-2024-6861
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
OSVRHSA-2022:8506 9.8

Red Hat Security Advisory: Satellite 6.12 Release

Record
RHSA-2022:8506
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
candlepin
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:4.1.15-1.el8sat
0:4.1.15-1.el8sat
candlepin-selinux
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:4.1.15-1.el8sat
0:4.1.15-1.el8sat
python-django
Red Hat:satellite_capsule:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.2.14-2.el8pc
0:3.2.14-2.el8pc
python39-django
Red Hat:satellite_capsule:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.2.14-2.el8pc
0:3.2.14-2.el8pc
python-django
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.2.14-2.el8pc
0:3.2.14-2.el8pc
python39-django
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.2.14-2.el8pc
0:3.2.14-2.el8pc
rubygem-nokogiri
Red Hat:satellite_capsule:6.12::el8
From an advisory covering 10 CVEs
 before 0:1.13.8-1.el8sat
0:1.13.8-1.el8sat
rubygem-nokogiri-debuginfo
Red Hat:satellite_capsule:6.12::el8
From an advisory covering 10 CVEs
 before 0:1.13.8-1.el8sat
0:1.13.8-1.el8sat
rubygem-nokogiri-debugsource
Red Hat:satellite_capsule:6.12::el8
From an advisory covering 10 CVEs
 before 0:1.13.8-1.el8sat
0:1.13.8-1.el8sat
rubygem-nokogiri
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:1.13.8-1.el8sat
0:1.13.8-1.el8sat
Show 24 moreShow less
Affected packages
PackageAffectedFixed
rubygem-nokogiri-debuginfo
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:1.13.8-1.el8sat
0:1.13.8-1.el8sat
rubygem-nokogiri-debugsource
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:1.13.8-1.el8sat
0:1.13.8-1.el8sat
rubygem-git
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:1.11.0-1.el8sat
0:1.11.0-1.el8sat
rubygem-sinatra
Red Hat:satellite_capsule:6.12::el8
From an advisory covering 10 CVEs
 before 1:2.2.0-1.el8sat
1:2.2.0-1.el8sat
rubygem-sinatra
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 1:2.2.0-1.el8sat
1:2.2.0-1.el8sat
rubygem-rails-html-sanitizer
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:1.4.3-2.el8sat
0:1.4.3-2.el8sat
foreman
Red Hat:satellite_capsule:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-debug
Red Hat:satellite_capsule:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman
Red Hat:satellite_utils:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-cli
Red Hat:satellite_utils:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-cli
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-debug
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-dynflow-sidekiq
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-ec2
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-gce
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-journald
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-libvirt
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-openstack
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-ovirt
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-postgresql
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-service
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-telemetry
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat
foreman-vmware
Red Hat:satellite:6.12::el8
From an advisory covering 10 CVEs
 before 0:3.3.0.17-1.el8sat
0:3.3.0.17-1.el8sat

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-6861 is a high vulnerability (CVSS 7.5) in Red Hat Satellite 6, published September 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.67%, the 52nd percentile. No source names a fixed version.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 121 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open