{"id":"CVE-2016-2100","details":"Foreman before 1.10.3 and 1.11.0 before 1.11.0-RC2 allow remote authenticated users to read, modify, or delete private bookmarks by leveraging the (1) edit_bookmarks or (2) destroy_bookmarks permission.","modified":"2026-08-18T08:25:27.348775Z","published":"2016-05-20T14:59:02.200Z","references":[{"type":"WEB","url":"http://projects.theforeman.org/issues/13828"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2016/03/31/2"},{"type":"ADVISORY","url":"http://theforeman.org/security.html#2016-2100"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHBA-2016:1500"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman","events":[{"introduced":"0"},{"last_affected":"bded92407146dd40f51640f93a8623190abec3e0"},{"introduced":"8731c1f6e50b5abd8f88db58f714c02dd584c419"},{"last_affected":"23e5b1ed28f5af52f61ae3f0335facfdc2fb8dfe"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.10.2"},{"introduced":"1.11.0"},{"last_affected":"1.11.0"},{"introduced":"1.11.0-rc1"},{"last_affected":"1.11.0-rc1"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*"]}}],"versions":["1.11.0","1.11.0-rc1","1.11.0-RC1","1.10.2","1.10.1","1.10.0","1.10.0-RC3","1.10.0-RC2","1.10.0-RC1","1.1","1.1RC5","1.1RC4","1.1RC3","1.1RC2","1.1RC1","1.0","1.0RC5","1.0RC4","1.0RC3","1.0RC2","1.0RC1","0.4","0.4rc5","0.4rc4","0.4rc3","0.4rc2","0.3","0.2","0.2rc1","0.1-6","0.1-5","0.1-4","0.1-3","0.1-2","0.1-1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2100.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/foreman-installer","events":[{"introduced":"0"},{"last_affected":"4a874f23772b42928dc652c7ab0ed6d8b9318e3e"},{"introduced":"5828e336f8ed7890e5dc9458fa580bd35efa9d69"},{"last_affected":"6aa4685b97fb1d2dca4e50f0e26497412f525d92"}],"database_specific":{"cpe":["cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"0"},{"last_affected":"1.10.2"},{"introduced":"1.11.0"},{"last_affected":"1.11.0"},{"introduced":"1.11.0-rc1"},{"last_affected":"1.11.0-rc1"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["1.11.0","1.11.0-rc1","1.10.2","1.11.0-RC1","1.10.1","1.10.0","1.10.0-RC3","1.10.0-RC2","1.10.0-RC1","1.0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2100.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/theforeman/smart-proxy","events":[{"introduced":"0"},{"last_affected":"1c7b5e542ac3977325d44f038c91ab636655d28d"},{"introduced":"27b23f5ab93b02faf66bb93579b79d52bcc4847f"},{"last_affected":"515fc38cd5b70c54d334e200a39212e87b3e1d35"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"last_affected":"1.10.2"},{"introduced":"1.11.0"},{"last_affected":"1.11.0"},{"introduced":"1.11.0-rc1"},{"last_affected":"1.11.0-rc1"}],"source":["CPE_RANGE","CPE_STRING"],"cpe":["cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:*","cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:*"]}}],"versions":["1.11.0","1.11.0-rc1","1.10.2","1.11.0-RC1","1.10.1","1.10.0","1.10.0-RC3","1.10.0-RC2","1.10.0-RC1","1.1","1.1RC3","1.1RC2","1.1RC1","1.0","1.0RC2","1.0RC1","0.3","0.2","0.2rc2","0.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-2100.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}]}