CVE-2015-3155: Foreman before 1.8.1 does not set the secure flag for the _session_id cookie in an https session, which mak...

Security readout for executives and security teams

Foreman versions before 1.8.1 could send the session cookie without the Secure flag. In mixed HTTP/HTTPS use, that can make an administrator’s session cookie easier to capture, creating a realistic account takeover risk for exposed management portals. Organizations running Foreman before 1.8.1 are the primary exposure. Risk is higher where Foreman is reachable over untrusted networks, permits HTTP access, or lacks strict HTTPS enforcement. The source bundle does not identify affected CPEs. Prioritize remediation for internet-facing or broadly reachable Foreman deployments. This affects session confidentiality for an infrastructure management system, so compromise could carry operational impact even though the bundle lacks a formal severity score. Mitigation focus: Upgrade Foreman to 1.8.1 or later.; Apply the relevant Red Hat advisory packages if using Red Hat-distributed Foreman.; Enforce HTTPS-only access to Foreman administrative interfaces..

Prepared

Jun 13, 2026, 22:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.