Foreman Smart-Proxy - Remote Command Injection

source: https://www.securityfocus.com/bid/68117/info Foreman is prone to a remote command-injection vulnerability. Successful exploits will result in the execution of arbitrary commands with the privileges of the user running foreman-proxy. curl -3 -H "Accept:application/json" -k -X POST -d...

Foreman Smart-Proxy - Remote Command Injection

Foreman Smart-Proxy - Remote Command Injection source: https://www.securityfocus.com/bid/68117/info Foreman is prone to a remote command-injection vulnerability. Successful exploits will result in the execution of arbitrary commands with the privileges of the user running foreman-proxy. curl -3 -...

CVE-2012-5477

The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors...

CVE-2013-0210

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

CVE-2013-0210

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

Code injection

The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors...

Command injection

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

CVE-2012-5477

The CVE entry describes a vulnerability in the Foreman smart proxy prior to version 1.1 where a misconfigured umask of 0 enables local users to modify files created by the daemon via unspecified vectors. The issue can affect integrity and availability (I:P, A:P) with local attack vector and no au...

CVE-2013-0210

CVE-2013-0210 affects Foreman’s smart proxy Puppet run API (Foreman) prior to version 1.2.0. The issue permits remote command execution via vectors related to escaping and Puppet commands. The NVD entry assigns a base score of 7.5 (HIGH) with network attack vector and no authentication, indicatin...

CVE-2013-0210

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

CVE-2012-5477

The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors...

CVE-2012-5477

The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors...

PT-2014-2311

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.1 Description The issue concerns the smart proxy in Foreman, where a umask set to 0 allows local users to modify files created by the daemon. Recommendations For versions prior to 1.1, update to version 1.1 or later...

CVE-2012-5477: Undefined Security Weakness

The smart proxy in Foreman before 1.1 uses a umask set to 0, which allows local users to modify files created by the daemon via unspecified vectors...

CVE-2013-0210: Improper Control of Generation of Code

The smart proxy Puppet run API in Foreman before 1.2.0 allows remote attackers to execute arbitrary commands via vectors related to escaping and Puppet commands...

PT-2014-2436

Name of the Vulnerable Software and Affected Versions Foreman versions prior to 1.2.0 Description The issue allows remote attackers to execute arbitrary commands. This is related to escaping and Puppet commands in the smart proxy Puppet run API. Recommendations For versions prior to 1.2.0, update...