CVE-2023-0462CWE-94

Arbitrary code execution through yaml global parameters

High · published September 20, 2023

CVSS v3.1
8.0
EPSS
1%
Percentile
61.2
In the wild
Unconfirmed
What it is

An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary code on the underlying operating system by setting global parameters with a YAML payload.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00961 · 61.2th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2023-09-20T13:40Z
EPSS history
Timeline
  • 20 SEP 13:40Z
    Arbitrary code execution through yaml global parameters
    cvelistv5