PT-2014-5939 · Foreman · Foreman

Lukas Zapletal · Publicado 2014-06-20 · Atualizado 2014-06-23 · CVE-2014-4507

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.4.5 Foreman versions 1.5.x prior to 1.5.1

Description A directory traversal issue exists, allowing remote attackers to overwrite arbitrary files by utilizing a .. (dot dot) in the dst parameter to the "tftp/fetch boot file" endpoint.

Recommendations For Foreman versions prior to 1.4.5, update to version 1.4.5 or later. For Foreman versions 1.5.x prior to 1.5.1, update to version 1.5.1 or later.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2014-4507

Produtos afetados

Foreman

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2014-4507 · Nota de Segurança
• http://projects.theforeman.org/issues/6086 · Correção