CVE-2022-3874
published 2023-09-22CVE-2022-3874: A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands…
PriorityP355critical9.1CVSS 3.1
AVNACLPRHUINSCCHIHAH
EPSS
2.17%
80.0th percentile
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | satellite | — | — |
| theforeman | foreman | 0 – 3.8.0 | — |
CVSS provenance
nvdv3.19.1CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
vendor_redhat8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
foreman: OS command injection via ct_command and fcct_command
vendor_redhat·2023-04-19·CVSS 8.0
CVE-2022-3874 [HIGH] CWE-78 foreman: OS command injection via ct_command and fcct_command
foreman: OS command injection via ct_command and fcct_command
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
GHSA
Foreman Transpilation Enables OS Command Injection
ghsa·2023-09-22
CVE-2022-3874 [CRITICAL] CWE-78 Foreman Transpilation Enables OS Command Injection
Foreman Transpilation Enables OS Command Injection
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-09-22
Published