NVD

Id
31842  
Name
CVE-2014-3691  
Description
Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-03-09  
Modified Date
2016-08-31  
Seq
2014-3691  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
167915 31842 CVE-2014-3691 http://projects.theforeman.org/issues/7822  View
167916 31842 CVE-2014-3691 RHSA-2015:0287  View
167917 31842 CVE-2014-3691 RHSA-2015:0288  View
167918 31842 CVE-2014-3691 https://github.com/theforeman/smart-proxy/pull/217  View
167919 31842 CVE-2014-3691 https://groups.google.com/forum/#!topic/foreman-announce/jXC5ixybjqo  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19086 JVNDB-2014-007961 Foreman の Smart Proxy における認証を回避される脆弱性 Foreman の Smart Proxy (別名 Smart-Proxy and foreman-proxy) は、SSL 証明書を検証しないため、認証を回避され、任意の API リクエストを実行される脆弱性が存在します。 CVE-2014-3691 70979 CVE-2014-3691 31842 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007961.html 2014-10-06 2015-03-11 View