CVE-2014-3691

Name: CVE-2014-3691
Creator: NVD / NIST
Published: 2015-03-09T14:59:00.077+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.71%

Last modified Jun 17, 2026

CVE-2014-3691 is a vulnerability of currently unknown severity. Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.. EPSS estimates a 1.71% chance of exploitation in the next 30 days.

Description

Smart Proxy (aka Smart-Proxy and foreman-proxy) in Foreman before 1.5.4 and 1.6.x before 1.6.2 does not validate SSL certificates, which allows remote attackers to bypass intended authentication and execute arbitrary API requests via a request without a certificate.

Metrics

EPSS Probability

1.71%

74.3th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-310

Affected Software

Vendor	Product	Versions
Redhat	Openstack	4.0
Redhat	Openstack	5.0
Theforeman	Foreman	<= 1.5.3
Theforeman	Foreman	1.6.0
Theforeman	Foreman	1.6.1

References

http://projects.theforeman.org/issues/7822Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0287.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0288.htmlThird Party Advisory
https://github.com/theforeman/smart-proxy/pull/217Issue Tracking, Patch
https://groups.google.com/forum/#%21topic/foreman-announce/jXC5ixybjqo
http://projects.theforeman.org/issues/7822Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2015-0287.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0288.htmlThird Party Advisory
https://github.com/theforeman/smart-proxy/pull/217Issue Tracking, Patch
https://groups.google.com/forum/#%21topic/foreman-announce/jXC5ixybjqo

Timeline

Published: Mar 9, 2015
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2014-3691?

How severe is CVE-2014-3691?

Severity scoring for CVE-2014-3691 is pending analysis. The EPSS model estimates a 1.71% probability of exploitation in the next 30 days.

How do I fix CVE-2014-3691?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2014-3691?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST