GHSA-9jfq-54vc-9rr2

Suggest an improvement
Source
https://github.com/advisories/GHSA-9jfq-54vc-9rr2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-9jfq-54vc-9rr2/GHSA-9jfq-54vc-9rr2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-9jfq-54vc-9rr2
Aliases
  • CVE-2022-3874
Withdrawn
2023-09-27T22:57:13Z
Published
2023-09-22T15:30:15Z
Modified
2026-09-10T03:49:57Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Foreman Transpilation Enables OS Command Injection
Details

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.

Database specific 
{
    "cwe_ids": [
        "CWE-78"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2023-09-27T00:34:08Z",
    "nvd_published_at": "2023-09-22T14:15:44Z",
    "severity": "CRITICAL"
}
References

Affected packages

RubyGems / foreman

Package

Name
foreman
Purl
pkg:gem/foreman

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
3.8.0

Affected versions

0.*
0.0.1
0.0.2
0.1.0
0.1.1
0.2.0
0.3.0
0.3.1
0.3.2
0.4.1
0.4.2
0.4.3
0.4.4
0.4.5
0.4.6
0.4.7
0.5.0
0.5.1
0.6.0
0.7.0
0.7.1
0.7.2
0.7.3
0.7.4
0.7.5
0.8.0
0.9.0.beta.1
0.9.0
0.9.1
0.9.2
0.10.0
0.10.1
0.11.0
0.11.1
0.12.0.pre1
0.12.0
0.13.0
0.13.1
0.14.0
0.15.0
0.16.0
0.17.0
0.18.0
0.19.0
0.20.0
0.21.0
0.22.0
0.23.1
0.24.0
0.25.0
0.26.0
0.26.1
0.27.0
0.28.0.pre1
0.28.0.pre2
0.29.0
0.30.0
0.30.1
0.31.0
0.32.0
0.33.0
0.33.1
0.34.0
0.34.1
0.35.0
0.36.0
0.36.1
0.37.0.pre1
0.37.0.pre2
0.37.0.pre3
0.37.0.pre4
0.37.0.pre5
0.37.0
0.37.1
0.37.2
0.38.0
0.39.0
0.40.0
0.41.0
0.42.0
0.43.0
0.44.0
0.45.0
0.46.0
0.47.0
0.48.0.pre1
0.48.0.pre2
0.48.0.pre3
0.48.0
0.49.0
0.50.0
0.51.0
0.52.0
0.53.0
0.54.0
0.55.0
0.56.0
0.57.0
0.58.0
0.59.0
0.60.0
0.60.2
0.61.0
0.62.0
0.63.0
0.64.0
0.65.0
0.66.0
0.67.0
0.69.0
0.70.0
0.71.0
0.73.0
0.74.0
0.75.0
0.76.0
0.77.0
0.78.0
0.80.0
0.80.1
0.80.2
0.81.0
0.82.0
0.83.0
0.84.0
0.85.0
0.86.0
0.87.0
0.87.1
0.87.2
0.88.1
0.89.1
0.90.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/09/GHSA-9jfq-54vc-9rr2/GHSA-9jfq-54vc-9rr2.json"