CVE-2013-2113

The create method in app/controllers/users_controller.rb in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.

CVSS v2.0 NVD

6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P

EPSS

20.93% chance of exploitation in the next 30 days, 98th percentile

Published

2013-07-31

Updated

2024-08-06

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/foreman_openstack_sa…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/27776

References

• CVE Record
• NVD entry