CVE-2021-3469

Foreman versions before 2.3.4 and before 2.4.0 is affected by an improper authorization handling flaw. An authenticated attacker can impersonate the foreman-proxy if product enable the Puppet Certificate authority (CA) to sign certificate requests that have subject alternative names (SANs). Foreman do not enable SANs by default and `allow-authorization-extensions` is set to `false` unless user change `/etc/puppetlabs/puppetserver/conf.d/ca.conf` configuration explicitly.

• CWE-863
• CWE-863

• https://bugzilla.redhat.com/show_bug.cgi?id=1943630Issue Tracking, Mitigation, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1943630Issue Tracking, Mitigation, Third Party Advisory

Published

Jun 3, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-34684Hitachi Vantara Pentaho Business Analytics through 9.1 allow…9.8
• CVE-2021-34685UploadService in Hitachi Vantara Pentaho Business Analytics …7.2
• CVE-2021-34686Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-34687iDrive RemotePC before 7.6.48 on Windows allows information …5.3
• CVE-2021-34688iDrive RemotePC before 7.6.48 on Windows allows information …3.3
• CVE-2021-34689iDrive RemotePC before 7.6.48 on Windows allows information …5.5
• CVE-2021-34690iDrive RemotePC before 7.6.48 on Windows allows authenticati…9.8
• CVE-2021-34691iDrive RemotePC before 4.0.1 on Linux allows denial of servi…7.5
• CVE-2021-34692iDrive RemotePC before 7.6.48 on Windows allows privilege es…7.8
• CVE-2021-34693net/can/bcm.c in the Linux kernel through 5.12.10 allows loc…5.5
• CVE-2021-34696A vulnerability in the access control list (ACL) programming…5.8
• CVE-2021-34697A vulnerability in the Protection Against Distributed Denial…8.6