Vulnerability · Published Sep 22, 2023 · Assigned by redhat
CVE-2022-3874Os command injection via ct_command and fcct_command
High 8.0
In plain English
A high-severity OS command injection in foreman. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities).
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)2.2%top 17.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| RubyGems | foreman | no fix listed | GHSA-9jfq-54vc-9rr2 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | foreman | see references |
| Red Hat | Red Hat Satellite 6 | see references |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
References
- https://access.redhat.com/security/cve/CVE-2022-3874 vdb-entry, x_refsource_REDHAT
- RHBZ#2140577 issue-tracking, x_refsource_REDHAT