CVE-2023-0118

CWE-78 — OS Command Injection4 documents4 sources
Severity
9.1CRITICAL
EPSS
0.0%
top 88.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Satellite
Timeline
PublishedSep 20

Description

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 2.3 | Impact: 6.0

Affected Packages1 packages

▶NVDredhat/satellite6.13 — 6.13.3

🔴Vulnerability Details

2
CVEList
Foreman: arbitrary code execution through templates↗2023-09-20
▶
GHSA
GHSA-pwc8-3cc6-gg8v: An arbitrary code execution flaw was found in Foreman↗2023-09-20
▶

📋Vendor Advisories

1
Red Hat
Foreman: Arbitrary code execution through templates↗2023-03-12
▶