CVE-2023-0462

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2023-0462	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2162970	Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*

History

22 Sep 2023, 23:12

Type	Values Removed	Values Added
References	~~(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2162970 -~~	(MISC) https://bugzilla.redhat.com/show_bug.cgi?id=2162970 - Issue Tracking, Third Party Advisory
References	~~(MISC) https://access.redhat.com/security/cve/CVE-2023-0462 -~~	(MISC) https://access.redhat.com/security/cve/CVE-2023-0462 - Third Party Advisory
CWE		CWE-94
First Time		Theforeman foreman Redhat satellite Redhat Theforeman
CPE		cpe:2.3:a:theforeman:foreman:::::::: cpe:2.3:a:redhat:satellite::::::::
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.1

20 Sep 2023, 14:25

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-09-20 14:15

Updated : 2023-12-10 15:14

NVD link : CVE-2023-0462

Mitre link : CVE-2023-0462

CVE.ORG link : CVE-2023-0462

JSON object : View

Products Affected

theforeman

foreman

redhat

satellite

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2023-0462", "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.0, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 1.3}]}, "published": "2023-09-20T14:15:12.990", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2023-0462", "tags": ["Third Party Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2162970", "tags": ["Issue Tracking", "Third Party Advisory"], "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-94"}]}, {"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en la ejecuci\u00f3n de c\u00f3digo arbitrario en Foreman. Este problema puede permitir que un usuario administrador ejecute c\u00f3digo arbitrario en el sistema operativo subyacente estableciendo par\u00e1metros globales con un payload YAML."}], "lastModified": "2023-11-07T04:00:31.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:theforeman:foreman:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "13E27457-9E93-45C1-907F-7E5852B4FD1F", "versionEndExcluding": "3.8.0"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:satellite:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1EF9AC67-8BDC-4B5E-B5A0-B9232033361B", "versionStartIncluding": "6.0"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}