CVE-2014-0007

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

Affected products

Foreman

Theforeman Foreman

≤ 1.4.4, 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.5.0

Fix

Available

CVSS 2.0

7.5 HIGH

EPSS

9.0% (95th percentile)

NVD status

Modified

Published

2014-06-20