{"id":"CVE-2021-3469","aliases":["EUVD-2021-26791","GHSA-gfhf-42qr-7pgh"],"status":"published","title":"Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling...","description":"Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00331,"percentile":0.26499,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2021-06-03T19:43:42Z","modified":"2026-10-24T10:31:02Z","products":[{"vendor":"the foreman","product":"foreman"},{"vendor":"theforeman","product":"foreman"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943630","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Mitigation","Third Party Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3469"},{"url":"https://github.com/advisories/GHSA-gfhf-42qr-7pgh"}],"sources":{"cve":[{"id":"CVE-2021-3469","description":"Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.","status":"published","published":"2021-06-03T19:43:42Z","modified":"2024-08-03T16:53:17.62Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:33:03.671751Z"}],"euvd":[{"id":"EUVD-2021-26791","description":"Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.","status":"published","published":"2021-06-03T19:43:42Z","modified":"2024-08-03T16:53:17Z","updated_at":"2026-11-03T03:25:13.052236Z"}],"ghsa":[{"id":"GHSA-gfhf-42qr-7pgh","title":"Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling...","description":"Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.","status":"published","published":"2022-05-24T19:03:57Z","modified":"2023-01-29T05:06:53Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:46:06.857512Z"}],"nvd":[{"id":"CVE-2021-3469","description":"Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.","status":"published","published":"2021-06-03T20:15:08.617Z","modified":"2026-06-17T04:05:09.657Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:06:53.987491Z"}],"osv":[{"id":"CVE-2021-3469","description":"Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.","status":"published","published":"2021-06-03T20:15:08.617Z","modified":"2026-10-24T10:31:02.329207024Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:20.13324Z"}]}}