Unauthorized Command Execution via Host Registration
CVE-2024-7700

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Satellite 6
Vendor
CVE Published:
12 August 2024

What is CVE-2024-7700?

A command injection vulnerability exists in the 'Host Init Config' template of the Foreman application. This flaw allows attackers with appropriate privileges to inject arbitrary commands via the 'Install Packages' field on the 'Register Host' page. While user interaction is required to execute the injected commands, it presents a substantial security risk if a user unknowingly runs the affected registration script. Mitigating this vulnerability is crucial for maintaining the integrity of host registration processes.

References

https://access.redhat.com/security/cve/CVE-2024-7700
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2304090
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.