CVE-2013-2121

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2013-2121
Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

6.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:M/Au:S/C:P/I:P/A:P

Exploitability : 6.8 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://projects.theforeman.org/issues/2631
http://rhn.redhat.com/errata/RHSA-2013-0995.html
http://www.exploit-db.com/exploits/27045 Exploit
https://bugzilla.redhat.com/show_bug.cgi?id=966804 Exploit
https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXU
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:openstack:3.0:*:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:*:rc1:*:*:*:*:*:*
cpe:2.3:a:theforeman:foreman:1.1:*:*:*:*:*:*:*
History

13 Feb 2023, 04:42

Type Values Removed Values Added
Summary CVE-2013-2121 Foreman: app/controllers/bookmarks_controller.rb remote code execution Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2013:0995', 'name': 'https://access.redhat.com/errata/RHSA-2013:0995', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2013-2121', 'name': 'https://access.redhat.com/security/cve/CVE-2013-2121', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=968166', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=968166', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHEA-2014:1175', 'name': 'https://access.redhat.com/errata/RHEA-2014:1175', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 18:17

Type Values Removed Values Added
Summary Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute. CVE-2013-2121 Foreman: app/controllers/bookmarks_controller.rb remote code execution
References
  • {'url': 'https://groups.google.com/forum/#!topic/foreman-users/6WpO_3ugiXU', 'name': 'https://groups.google.com/forum/#!topic/foreman-users/6WpO_3ugiXU', 'tags': [], 'refsource': 'CONFIRM'}
  • (MISC) https://groups.google.com/forum/#%21topic/foreman-users/6WpO_3ugiXU -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=968166 -
  • (MISC) https://access.redhat.com/errata/RHEA-2014:1175 -
  • (MISC) https://access.redhat.com/errata/RHSA-2013:0995 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2013-2121 -
Information

Published : 2013-07-31 13:20

Updated : 2023-12-10 11:16

NVD link : CVE-2013-2121

Mitre link : CVE-2013-2121

CVE.ORG link : CVE-2013-2121

JSON object : View

Products Affected

theforeman

  • foreman

redhat

  • openstack
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')