CVE-2021-3589.yml

---
gem: foreman_ansible
cve: 2021-3589
ghsa: vvff-6wrr-4g7q
url: https://access.redhat.com/security/cve/CVE-2021-3589
title: Missing Authentication for Critical Function in Foreman Ansible
date: 2022-03-24
description: |
  An authorization flaw was found in Foreman Ansible. An authenticated attacker
  with certain permissions to create and run Ansible jobs can access hosts
  through job templates. The highest threat from this vulnerability is to data
  confidentiality and integrity as well as system availability.
cvss_v3: 9.9
patched_versions:
  - ">= 2.0.0"
related:
  url:
    - https://bugzilla.redhat.com/show_bug.cgi?id=1969265
    - https://github.com/theforeman/foreman_ansible/commit/a5e0827bc3ec6c8ab82f968907857a15646305d5