Vulnerability Description
discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local users with access to the system journal to obtain the root password by reading the system journal, or by clicking Logs on the console.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Satellite | 6.3 |
| Redhat | Enterprise Linux Server | 7.0 |
Related Weaknesses (CWE)
References
- https://access.redhat.com/errata/RHSA-2018:0336Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1349136Issue TrackingThird Party Advisory
- https://access.redhat.com/errata/RHSA-2018:0336Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1349136Issue TrackingThird Party Advisory
FAQ
What is CVE-2016-4996?
CVE-2016-4996 is a vulnerability with a CVSS score of 7.0 (HIGH). discovery-debug in Foreman before 6.2 when the ssh service has been enabled on discovered nodes displays the root password in plaintext in the system journal when used to log in, which allows local us...
How severe is CVE-2016-4996?
CVE-2016-4996 has been rated HIGH with a CVSS base score of 7.0/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-4996?
Check the references section above for vendor advisories and patch information. Affected products include: Redhat Satellite, Redhat Enterprise Linux Server.