by Kastro
Paper/Archive/CVE-2023-0118

CVE-2023-0118

Red Hat Red Hat Satellite 6.11 for RHEL 7 — Foreman: arbitrary code execution through templates

EPSS 1%CVSS 9.1
critical.is priorityof 100
42
CVSS 9.1 (CNA, NVD agree)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 72.2.722 × 2014.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.

Affected

ProductAffectedFixed inSource
foremansee advisory–CNA
Red Hat Satellite 6.11 for RHEL 7see advisory0:3.1.1.27-1.el7satCNA
Red Hat Satellite 6.11 for RHEL 7see advisory0:3.1.1.27-1.el7satCNA
Red Hat Satellite 6.11 for RHEL 8see advisory0:3.1.1.27-1.el8satCNA
Red Hat Satellite 6.11 for RHEL 8see advisory0:3.1.1.27-1.el8satCNA
Red Hat Satellite 6.12 for RHEL 8see advisory0:1.3.8-1.el8satCNA
Red Hat Satellite 6.13 for RHEL 8see advisory0:1.3.8-1.el8satCNA
Red Hat Satellite 6.14 for RHEL 8see advisory0:3.7.0.9-1.el8satCNA
Red Hat Satellite 6.14 for RHEL 8see advisory0:3.7.0.9-1.el8satCNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
redhat (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

advisoryaccess.redhat.com/errata/RHSA-2023:4466advisoryaccess.redhat.com/errata/RHSA-2023:5979advisoryaccess.redhat.com/errata/RHSA-2023:5980advisoryaccess.redhat.com/errata/RHSA-2023:6818refaccess.redhat.com/security/cve/CVE-2023-0118refbugzilla.redhat.com/show_bug.cgi?id=2159291