CVE-2019-3893

In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "delete_compute_resource" permission can use this flaw to take control over compute resources managed by foreman. Versions before 1.20.3, 1.21.1, 1.22.0 are vulnerable.

• CWE-732
• CWE-732

• http://www.openwall.com/lists/oss-security/2019/04/14/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107846Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3893Issue Tracking, Third Party Advisory
• https://github.com/theforeman/foreman/pull/6621Third Party Advisory
• https://projects.theforeman.org/issues/26450Vendor Advisory
• http://www.openwall.com/lists/oss-security/2019/04/14/2Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107846Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3893Issue Tracking, Third Party Advisory
• https://github.com/theforeman/foreman/pull/6621Third Party Advisory
• https://projects.theforeman.org/issues/26450Vendor Advisory

Published

Apr 9, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3887A flaw was found in the way KVM hypervisor handled x2APIC Ma…5.6
• CVE-2019-3888A vulnerability was found in Undertow web server before 2.0.…9.8
• CVE-2019-3889A reflected XSS vulnerability exists in authorization flow o…5.4
• CVE-2019-3890It was discovered evolution-ews before 3.31.3 does not check…8.1
• CVE-2019-3891It was discovered that a world-readable log file belonging t…7.8
• CVE-2019-3892Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-3894It was discovered that the ElytronManagedThread in Wildfly's…8.8
• CVE-2019-3895An access-control flaw was found in the Octavia service when…8
• CVE-2019-3896A double-free can happen in idr_remove_all() in lib/idr.c in…7
• CVE-2019-3897It has been discovered in redhat-certification that any unau…5.3
• CVE-2019-3898Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-3899It was found that default configuration of Heketi does not r…9.8