A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
| Vendor | Product | Versions |
|---|---|---|
| red hat | red hat satellite 6.16 for rhel | — |
Updated severity to HIGH and marked the vulnerability as actively exploited with an exploit available.
Updated severity to HIGH, marked as actively exploited, and added CWE-77.
Initial creation
