CVE-2022-3874 — Os command injection via ct_command and fcct_command

CVE-2022-3874

Os command injection via ct_command and fcct_command PUBLISHED

Description (CNA)

A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.

Affected (CNA)

Vendor / product	Versions
n/a / foreman	affected
Red Hat / Red Hat Satellite 6	affected

CWE

CWE-78

References

https://access.redhat.com/security/cve/CVE-2022-3874
https://bugzilla.redhat.com/show_bug.cgi?id=2140577

ADP enrichment

CVE

No English description supplied.

https://access.redhat.com/security/cve/CVE-2022-3874
https://bugzilla.redhat.com/show_bug.cgi?id=2140577

CISA-ADP

No English description supplied.

No references supplied.