Total vulnerabilities in the database
The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
| Software | From | Fixed in |
|---|---|---|
| theforeman / foreman | - | 1.2.0.x |
| redhat / openstack | 3.0 | 3.0.x |
| theforeman / foreman | 1.1 | 1.1.x |