← Vulnerability feed

Vulnerability record · CVE-2017-2662 · published 22 August 2018

CVE-2017-2662: Theforeman katello missing authorization vulnerability

Theforeman · Katello

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

4.3 CVSS 3.0 Medium EPSS 0.94% · top 40.7% CWE-862 · Missing authorizationCWE-269 · Improper privilege management
4.3CVSS 3.0 base score, v2 4.0
0.94%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A flaw was found in Foreman's katello plugin version 3.4.5. After setting a new role to allow restricted access on a repository with a filter (filter set on the Product Name), the filter is not respected when the actions are done via hammer using the repository id.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662 Issue TrackingThird Party Advisory
https://projects.theforeman.org/issues/18838 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2662 Issue TrackingThird Party Advisory
https://projects.theforeman.org/issues/18838 Vendor Advisory

Track CVE-2017-2662 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2012-3503Theforeman katello hard-coded credentials vulnerabilityThe installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default in…EPSS 3.0%7.5CVE-2013-4120Theforeman katello uncontrolled resource consumption vulnerabilityKatello has a Denial of Service vulnerability in API OAuth authenticationEPSS 1.3%6.5CVE-2013-2143Katello and Red Hat Satellite missing authorization in update_rolesThe users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action. A remote authe…EPSS 48%analysed5.5CVE-2016-9595Theforeman katello link following vulnerabilityA flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files. A local user could exploit this fla…EPSS 0.40%5.4CVE-2013-0283Theforeman katello cross-site scripting vulnerabilityKatello: Username in Notification page has cross site scriptingEPSS 0.55%5.4CVE-2013-2101Theforeman katello cross-site scripting vulnerabilityKatello has multiple XSS issues in various entitiesEPSS 0.55%5.4CVE-2018-16887Redhat satellite cross-site scripting vulnerabilityA cross-site scripting (XSS) flaw was found in the katello component of Satellite. An attacker with privilege to create/edit organizations and locati…EPSS 1.00%4.3CVE-2018-14623Theforeman katello sql injection vulnerabilityA SQL injection flaw was found in katello's errata-related API. An authenticated remote attacker can craft input data to force a malformed SQL query …EPSS 1.4%

Source: NIST National Vulnerability Database (record CVE-2017-2662), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.