Foreman Transpilation Enables OS Command Injection
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2022-3874US | critical9.1 | — | ||
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/security/cve/CVE-2022-3874WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2140577WEB
- https://github.com/theforeman/foremanPACKAGE
- https://github.com/theforeman/foreman/pull/9836WEB
- https://github.com/theforeman/theforeman.org/pull/2101WEB
- https://nvd.nist.gov/vuln/detail/CVE-2022-3874ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan