CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 6.0
CWE Name:  Permissions Privileges and Access Controls
Summary: the create method in app/controllers/users_controller.rb in foreman before 1.2.0-rc2 allows remote authenticated users with permissions to create or edit other users to gain privileges by (1) changing the admin flag or (2) assigning an arbitrary role.
Access Authentication: SINGLE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): PARTIAL/PARTIAL/PARTIAL
Published Date: 2013-07-31
Last Modified Date: 2018-08-13