CVE-2023-0118criticalCWE-78

CVE-2023-0118: falha crítica em foreman

Foreman: arbitrary code execution through templates

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Red Hat Satellite+ Monitorar foreman

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

28Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.1epss 1.4%
An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Produtos afetados
foremanRed Hat · Red Hat Satellite 6.11 for RHEL 7Red Hat · Red Hat Satellite 6.11 for RHEL 8Red Hat · Red Hat Satellite 6.12 for RHEL 8Red Hat · Red Hat Satellite 6.13 for RHEL 8Red Hat · Red Hat Satellite 6.14 for RHEL 8
CVEs relacionadas — foreman

No mesmo produto, das mais perigosas para as menos.

CVE-2024-7700MEDIUMForeman: command injection in "host init config" template via "install packages" field on foremanEPSS 0.8%CVE-2024-6861HIGHForeman: foreman: oauth secret exposure via unauthenticated access to the graphql apiEPSS 0.7%CVE-2024-4871MEDIUMForeman: host ssh key not being checked in remote executionEPSS 0.6%CVE-2023-0119MEDIUMForeman: stored cross-site scripting in host tabEPSS 0.6%CVE-2024-8553MEDIUMForeman: read-only access to entire db from templatesEPSS 0.4%