{"id":"CVE-2023-0118","state":"PUBLISHED","title":"Foreman: arbitrary code execution through templates","description":"An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system.","publishedAt":"2023-09-20T13:39:27.756Z","updatedAt":"2024-09-17T13:51:28.373Z","severity":{"score":9.1,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"redhat"},"assigner":"redhat","products":["foreman","Red Hat Red Hat Satellite 6.11 for RHEL 7","Red Hat Red Hat Satellite 6.11 for RHEL 8","Red Hat Red Hat Satellite 6.12 for RHEL 8","Red Hat Red Hat Satellite 6.13 for RHEL 8","Red Hat Red Hat Satellite 6.14 for RHEL 8"],"affected":[{"packageName":"foreman","defaultStatus":"affected","collectionURL":"https://github.com/theforeman/foreman"},{"vendor":"Red Hat","product":"Red Hat Satellite 6.11 for RHEL 7","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.1.1.27-1.el7sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.11::el8","cpe:/a:redhat:satellite_capsule:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el8","cpe:/a:redhat:satellite:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el7","cpe:/a:redhat:satellite:6.11::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.11 for RHEL 7","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.1.1.27-1.el7sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.11::el8","cpe:/a:redhat:satellite_capsule:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el8","cpe:/a:redhat:satellite:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el7","cpe:/a:redhat:satellite:6.11::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.11 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.1.1.27-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.11::el8","cpe:/a:redhat:satellite_capsule:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el8","cpe:/a:redhat:satellite:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el7","cpe:/a:redhat:satellite:6.11::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.11 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.1.1.27-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.11::el8","cpe:/a:redhat:satellite_capsule:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el8","cpe:/a:redhat:satellite:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el7","cpe:/a:redhat:satellite:6.11::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.12 for RHEL 8","packageName":"rubygem-safemode","defaultStatus":"affected","versions":[{"version":"0:1.3.8-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.12::el8","cpe:/a:redhat:satellite_capsule:6.12::el8","cpe:/a:redhat:satellite_utils:6.12::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.13 for RHEL 8","packageName":"rubygem-safemode","defaultStatus":"affected","versions":[{"version":"0:1.3.8-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.13::el8","cpe:/a:redhat:satellite_utils:6.13::el8","cpe:/a:redhat:satellite_maintenance:6.13::el8","cpe:/a:redhat:satellite:6.13::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.14 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.7.0.9-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_maintenance:6.14::el8","cpe:/a:redhat:satellite_utils:6.14::el8","cpe:/a:redhat:satellite:6.14::el8","cpe:/a:redhat:satellite_capsule:6.14::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.14 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.7.0.9-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_maintenance:6.14::el8","cpe:/a:redhat:satellite_utils:6.14::el8","cpe:/a:redhat:satellite:6.14::el8","cpe:/a:redhat:satellite_capsule:6.14::el8"]}],"references":["https://access.redhat.com/errata/RHSA-2023:4466","https://access.redhat.com/errata/RHSA-2023:5979","https://access.redhat.com/errata/RHSA-2023:5980","https://access.redhat.com/errata/RHSA-2023:6818","https://access.redhat.com/security/cve/CVE-2023-0118","https://bugzilla.redhat.com/show_bug.cgi?id=2159291"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:05:36.141Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2023/0xxx/CVE-2023-0118.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2023-0118","state":"PUBLISHED","datePublished":"2023-09-20T13:39:27.756Z","dateUpdated":"2024-09-17T13:51:28.373Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2023-01-09T13:21:05.016Z"},"containers":{"cna":{"title":"Foreman: arbitrary code execution through templates","descriptions":[{"lang":"en","value":"An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in templates and execute arbitrary code on the underlying operating system."}],"affected":[{"packageName":"foreman","defaultStatus":"affected","collectionURL":"https://github.com/theforeman/foreman"},{"vendor":"Red Hat","product":"Red Hat Satellite 6.11 for RHEL 7","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.1.1.27-1.el7sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.11::el8","cpe:/a:redhat:satellite_capsule:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el8","cpe:/a:redhat:satellite:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el7","cpe:/a:redhat:satellite:6.11::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.11 for RHEL 7","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.1.1.27-1.el7sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.11::el8","cpe:/a:redhat:satellite_capsule:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el8","cpe:/a:redhat:satellite:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el7","cpe:/a:redhat:satellite:6.11::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.11 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.1.1.27-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.11::el8","cpe:/a:redhat:satellite_capsule:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el8","cpe:/a:redhat:satellite:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el7","cpe:/a:redhat:satellite:6.11::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.11 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.1.1.27-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.11::el8","cpe:/a:redhat:satellite_capsule:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el8","cpe:/a:redhat:satellite:6.11::el7","cpe:/a:redhat:satellite_utils:6.11::el7","cpe:/a:redhat:satellite:6.11::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.12 for RHEL 8","packageName":"rubygem-safemode","defaultStatus":"affected","versions":[{"version":"0:1.3.8-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite:6.12::el8","cpe:/a:redhat:satellite_capsule:6.12::el8","cpe:/a:redhat:satellite_utils:6.12::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.13 for RHEL 8","packageName":"rubygem-safemode","defaultStatus":"affected","versions":[{"version":"0:1.3.8-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_capsule:6.13::el8","cpe:/a:redhat:satellite_utils:6.13::el8","cpe:/a:redhat:satellite_maintenance:6.13::el8","cpe:/a:redhat:satellite:6.13::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.14 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.7.0.9-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_maintenance:6.14::el8","cpe:/a:redhat:satellite_utils:6.14::el8","cpe:/a:redhat:satellite:6.14::el8","cpe:/a:redhat:satellite_capsule:6.14::el8"]},{"vendor":"Red Hat","product":"Red Hat Satellite 6.14 for RHEL 8","packageName":"foreman","defaultStatus":"affected","versions":[{"version":"0:3.7.0.9-1.el8sat","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:satellite_maintenance:6.14::el8","cpe:/a:redhat:satellite_utils:6.14::el8","cpe:/a:redhat:satellite:6.14::el8","cpe:/a:redhat:satellite_capsule:6.14::el8"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2023:4466","name":"RHSA-2023:4466","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5979","name":"RHSA-2023:5979","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5980","name":"RHSA-2023:5980","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6818","name":"RHSA-2023:6818","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0118","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159291","name":"RHBZ#2159291","tags":["issue-tracking","x_refsource_REDHAT"]}],"metrics":[{"other":{"content":{"value":"Important","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2024-05-03T15:32:29.709Z"},"datePublic":"2023-03-12T00:00:00.000Z","x_redhatCweChain":"CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","timeline":[{"lang":"en","time":"2022-12-12T00:00:00.000Z","value":"Reported to Red Hat."},{"lang":"en","time":"2023-03-12T00:00:00.000Z","value":"Made public."}],"credits":[{"lang":"en","value":"Red Hat would like to thank Andrew Danau (Onsec.io) for reporting this issue."}]},"adp":[{"title":"CVE Program Container","references":[{"url":"https://access.redhat.com/errata/RHSA-2023:4466","name":"RHSA-2023:4466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5979","name":"RHSA-2023:5979","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:5980","name":"RHSA-2023:5980","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6818","name":"RHSA-2023:6818","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-0118","tags":["vdb-entry","x_refsource_REDHAT","x_transferred"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159291","name":"RHBZ#2159291","tags":["issue-tracking","x_refsource_REDHAT","x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-02T05:02:43.821Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-08-07T18:09:30.819280Z","id":"CVE-2023-0118","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-09-17T13:51:28.373Z"}}]}}}