Name: CVE-2023-0118: Improper Neutralization of Special Elements used in an OS Command
Creator: Rapid7
Published: 2023-09-20T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2023-0118, CWE-78, CVSS 9.1, EPSS 0.01382

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.

CVSS Details

CVSS 3.1 Base Score: 9.1
CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Centos_linux	—	Upgrade foreman-cliUpgrade satellite-brandingUpgrade satellite-cliUpgrade satellite	Aug 4, 2023	Aug 3, 2023
Redhat_linux	—	Upgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hashieUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-foreman_maintainUpgrade rubygem-netrcUpgrade rubygem-version_gemUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-brandingUpgrade rubygem-ffi-debugsourceUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-clampUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_tasksUpgrade foreman-cliUpgrade rubygem-unicode-debuginfoUpgrade rubygem-loggingUpgrade rubygem-highlineUpgrade rubygem-jwtUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-ffiUpgrade rubygem-unf_extUpgrade satelliteUpgrade rubygem-powerbarUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-mime-typesUpgrade rubygem-multi_jsonUpgrade rubygem-amazing_printUpgrade rubygem-unfUpgrade rubygem-localeUpgrade rubygem-little-pluggerUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_googleUpgrade satellite-cliUpgrade rubygem-unicode-debugsourceUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-fast_gettextUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_katelloUpgrade satellite-cloneUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-http-cookieUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-apipie-bindingsUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-rest-clientUpgrade rubygem-hammer_cliUpgrade rubygem-mime-types-dataUpgrade rubygem-unicode	Aug 4, 2023	Aug 3, 2023
Rocky_linux	—	Upgrade libdb-cxx-debuginfoUpgrade libdb-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-sql-devel-debuginfoUpgrade libdb-cxxUpgrade libdb-debugsourceUpgrade libdb-utils-debuginfo	Mar 5, 2024	Sep 20, 2023

Prioritise with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business