Foreman: command injection in "host init config" template via "install packages" field on foreman
Vulnerability Description
A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the configuration, potentially allowing unauthorized command execution during host registration. Although this issue requires user interaction to execute injected commands, it poses a significant risk if an unsuspecting user runs the generated registration script.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7700
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Red Hat would like to thank Markus Reisner (ATIX AG) for reporting this issue.
References
More from Unknown
View All →Affected Vendor
Unknown
View all reports →