CVE-2022-3874: high-severity vulnerability in foreman
Os command injection via ct_command and fcct_command
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8epss 2.2%
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
Related CVEs — foreman
In the same product, most dangerous first.
CVE-2013-2056HIGHRed hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypassEPSS 2.6%CVE-2026-1961HIGHForman: foreman: remote code execution via command injection in websocket proxyEPSS 1.9%CVE-2026-12405HIGHRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterEPSS 1.6%CVE-2011-4346MEDIUMSatellite: xss in custom system information key handlingEPSS 1.2%CVE-2026-12541HIGHForeman: command injection in foreman-rake database tasksEPSS 1.2%CVE-2026-12540HIGHForeman: command injection in foreman-rake errors:fetch_log via request_id parameterEPSS 1.2%