Yüksek CVSS 8.8 PoC var
CVE-2026-1961: Satellite: işletim sistemi komut enjeksiyonu
Açıklama (NVD)
A flaw was found in Foreman. A remote attacker could exploit a command injection vulnerability in Foreman's WebSocket proxy implementation. This vulnerability arises from the system's use of unsanitized hostname values from compute resource providers when constructing shell commands. By operating a malicious compute resource server, an attacker could achieve remote code execution on the Foreman server when a user accesses VM VNC console functionality. This could lead to the compromise of sensitive credentials and the entire managed infrastructure.
Özet bilgiler
- Ürün
- Redhat Satellite
- CVSS v3.1
- 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS
- %1,92 (yüzdelik 80)
- CWE
- CWE-78
- Yama
- Yok / bilinmiyor
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| redhat-satellite | 6.16 | — | 6.16.7 |
| redhat-satellite | 6.17 | — | 6.17.7 |
| theforeman-foreman | — | — | 3.16.3 |
| theforeman-foreman | 3.17.0 | — | 3.17.2 |
| theforeman-foreman | 3.18.0 | — | 3.18.1 |
| redhat-satellite | 6.18 | — | 6.18.4 |
| redhat-satellite | 6.0 | 6.0 | — |