Unscored severity · published Aug 14, 2015
CVE-2015-3155
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting…
–
CVSS
2.2%
EPSS
No
On KEV
Description
Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
Exploitation
Is it being used?
Exploit prediction (EPSS)2.2% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FO
Foreman · Theforeman
through 1.8.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-3155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-3155
Vendor Advisory
http://projects.theforeman.org/issues/10275
access.redhat.com
https://access.redhat.com/errata/RHSA-2015:1591
access.redhat.com
https://access.redhat.com/errata/RHSA-2015:1592
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1216035
Patch
https://github.com/theforeman/foreman/pull/2328
groups.google.com
https://groups.google.com/forum/#%21topic/foreman-announce/QPtN0h04jdo
More from Foreman
9.8
CVE-2018-14643
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman
9.1
CVE-2026-96659
Foreman: excessive permissions for viewer role on preview
9.1
CVE-2022-3874
A command injection flaw was found in foreman
9.1
CVE-2023-0462
An arbitrary code execution flaw was found in Foreman
9.1
CVE-2023-0118
An arbitrary code execution flaw was found in Foreman