CVE-2021-3584 — OS Command Injection in Foreman

CWE-78 — OS Command Injection4 documents4 sources
Severity
7.2HIGHNVD
EPSS
0.5%
top 35.19%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Theforeman ForemanRedhat Satellite
Timeline
PublishedDec 23
Latest updateDec 24

Description

A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages3 packages

▶NVDtheforeman/foreman2.5.0 — 2.5.1+2
▶CVEListV5theforeman/foremanforeman 2.4.1, foreman 2.5.1, foreman 3.0.0

Patches

Patch: github.com ↗Patch: projects.theforeman.org ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-x4xp-c8qv-8gww: A server side remote code execution vulnerability was found in Foreman project↗2021-12-24
▶
CVEList
CVE-2021-3584: A server side remote code execution vulnerability was found in Foreman project↗2021-12-23
▶

📋Vendor Advisories

1
Red Hat
foreman: Authenticate remote code execution through Sendmail configuration↗2021-06-16
▶
CVE-2021-3584 — OS Command Injection in Foreman | cvebase