An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
CVSS Details
- CVSS 3.1 Base Score: 9.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade foreman-cliUpgrade satellite-brandingUpgrade satellite-cliUpgrade satellite | Aug 4, 2023 | Aug 3, 2023 |
| Redhat_linux | — | Upgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-apipie-bindingsUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unf_extUpgrade rubygem-http-cookieUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-ffiUpgrade rubygem-fast_gettextUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-mime-types-dataUpgrade rubygem-hammer_cliUpgrade rubygem-unicodeUpgrade python39-pulp_manifestUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-powerbarUpgrade rubygem-domain_nameUpgrade rubygem-ffi-debuginfoUpgrade rubygem-mime-typesUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unfUpgrade satellite-cloneUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-little-pluggerUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-localeUpgrade rubygem-loggingUpgrade rubygem-clampUpgrade satellite-maintainUpgrade rubygem-jwtUpgrade rubygem-ffi-debugsourceUpgrade rubygem-highlineUpgrade rubygem-unicode-debuginfoUpgrade foreman-cliUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hashieUpgrade rubygem-http-acceptUpgrade rubygem-foreman_maintainUpgrade rubygem-version_gemUpgrade rubygem-netrcUpgrade rubygem-unf_ext-debugsourceUpgrade satellite-brandingUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade satelliteUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-unicode-display_widthUpgrade rubygem-snaky_hashUpgrade rubygem-hammer_cli_foreman_tasks | Aug 4, 2023 | Aug 3, 2023 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-devel-debuginfoUpgrade libdb-debugsource | Mar 5, 2024 | Sep 20, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub