PT-2014-3429 · Foreman · Foreman

Published 2014-06-20 · Updated 2023-02-13 · CVE-2014-0007

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.4.5 Foreman versions 1.5.x prior to 1.5.1

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to the "tftp/fetch boot file" endpoint.

Recommendations For versions prior to 1.4.5, update to version 1.4.5 or later. For versions 1.5.x prior to 1.5.1, update to version 1.5.1 or later.

Exploit

Fix

Related Identifiers

CVE-2014-0007

RHSA-2014:0770

Affected Products

Foreman

References · 4

• 🔥 https://exploit-db.com/exploits/39222 · Exploit
• http://rhn.redhat.com/errata/RHSA-2014-0770.html · Vendor Advisory
• http://projects.theforeman.org/issues/6086 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2014-0007 · Security Note