HIGH🇵🇱 Wersja polska

CVE-2022-3874

CVSS 8.0v3.1pub. 2023-09-22upd. 2024-11-21

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.

CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Red Hat Satellite

    APP
    Redhat
    6.0

  • Theforeman Foreman

    APP
    Theforeman
    all versions
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2016-3427CRITICAL9.8⚠ KEVPL ✓same product

Krytyczna podatność RCE w Oracle Java SE i JRockit — komponent JMX

CVE-2015-2590CRITICAL9.8⚠ KEVPL ✓same product

Krytyczna podatność RCE w Oracle Java SE — komponent Libraries

CVE-2024-7923CRITICAL9.8PL ✓same product

Authentication bypass w Pulpcore/Red Hat Satellite przez nagłówek HTTP

CVE-2024-7012CRITICAL9.8PL ✓same product

Authentication Bypass w Foreman/Red Hat Satellite via zniekształcony nagłówek HTTP

CVE-2023-0118CRITICAL9.1PL ✓same product

Arbitrary code execution w Foreman — obejście safe mode w szablonach