CVE-2023-0462
Arbitrary code execution through yaml global parameters
- State
- Published
- Severity
- 8.0 High
- Published
- Sep 20, 2023
- Updated
- Sep 24, 2024
- Reserved
- Jan 24, 2023
Description
An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.0 High | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | redhat |
Weaknesses
- CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected Products
| Product | Versions |
|---|---|
foremann/a | |
Red Hat Satellite 6Red Hat |
References
- https://access.redhat.com/security/cve/CVE-2023-0462vdb-entry
- RHBZ#2162970issue-tracking
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.