CVE-2023-0118
Foreman: arbitrary code execution through templates
CVSS Score
9.1
EPSS Score
0.0%
EPSS Percentile
0th
An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.
| CWE | CWE-78 |
| Published | Sep 20, 2023 |
| Last Updated | Sep 17, 2024 |
Stay Ahead of the Next One
Get instant alerts for
Be the first to know when new critical vulnerabilities are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Red Hat / Red Hat Satellite 6.11 for RHEL 7
All versions affected Red Hat / Red Hat Satellite 6.11 for RHEL 7
All versions affected Red Hat / Red Hat Satellite 6.11 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.11 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.12 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.13 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.14 for RHEL 8
All versions affected Red Hat / Red Hat Satellite 6.14 for RHEL 8
All versions affected References
access.redhat.com: https://access.redhat.com/errata/RHSA-2023:4466 access.redhat.com: https://access.redhat.com/errata/RHSA-2023:5979 access.redhat.com: https://access.redhat.com/errata/RHSA-2023:5980 access.redhat.com: https://access.redhat.com/errata/RHSA-2023:6818 access.redhat.com: https://access.redhat.com/security/cve/CVE-2023-0118 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2159291
Credits
Red Hat would like to thank Andrew Danau (Onsec.io) for reporting this issue.