high8.1
CVE-2015-5152
Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to o…
Impact
Foreman after 1.1 and before 1.9.0-RC1 does not redirect HTTP requests to HTTPS when the require_ssl setting is set to true, which allows remote attackers to obtain user credentials via a man-in-the-middle attack.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Theforeman | Foreman | Versions 1.1-1, 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.3.0 |