CVE-2021-3494

    Dashboard / Vulnerabilities / CVE-2021-3494

    CVE-2021-3494

    Published: 26 Apr 2021Last Modified: 9 Jul 2026

    Summary:

    Details: A smart proxy that provides a restful API to various sub-systems of the Foreman is affected by the flaw which can cause a Man-in-the-Middle attack. The FreeIPA module of Foreman smart proxy does not check the SSL certificate, thus, an unauthenticated attacker can perform actions in FreeIPA if certain conditions are met. The highest threat from this flaw is to system confidentiality. This flaw affects Foreman versions before 2.5.0.

    References: https://bugzilla.redhat.com/show_bug.cgi?id=1948005

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -4cb58d3daed9474d7e348df218574ac418a3dfd8

    Affected versions

    2.5.0-rc3
    2.5.0-rc2
    2.5.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-3494 | CVE-DB