CVE-2022-3874: fallo de gravedad alta en foreman
Os command injection via ct_command and fcct_command
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8epss 2.2%
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVEs relacionadas — foreman
En el mismo producto, de las más peligrosas a las menos.
CVE-2013-2056HIGHRed hat network satellite: red hat network satellite: information disclosure via inter-satellite sync (iss) authentication bypassEPSS 2.6%CVE-2026-1961HIGHForman: foreman: remote code execution via command injection in websocket proxyEPSS 1.9%CVE-2026-12405HIGHRubygem-foreman_remote_execution: command injection in job invocations via effective_user parameterEPSS 1.6%CVE-2026-89059HIGHResteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)EPSS 1.5%CVE-2011-4346MEDIUMSatellite: xss in custom system information key handlingEPSS 1.2%CVE-2026-12541HIGHForeman: command injection in foreman-rake database tasksEPSS 1.2%