CVE-2021-3584: OS Command Injection
A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this vulnerability is to confidentiality, integrity and availability of system. Fixed releases are 2.4.1, 2.5.1, 3.0.0.
Other sources
Foreman upstream is affected by the remote code execution flaw which allows authenticated attacker to perform remote code execution attack. In this type of vulnerability an attacker is able to run command of their choosing with system level privileges on a server that possesses the appropriate weakness but this is only possible when attacker have gain some high-level privileges on the Foreman.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-3584.
What is the severity of CVE-2021-3584?
The severity of CVE-2021-3584 is critical (7.2).
Which software versions are affected by CVE-2021-3584?
Versions up to and excluding 2.4.1, 2.5.1, and 3.0.0 of the Foreman project are affected.
How can an attacker exploit this vulnerability?
An authenticated attacker could exploit this vulnerability by using Sendmail configuration options to perform command injection.
Where can I find more information about CVE-2021-3584?
You can find more information about CVE-2021-3584 in the following references: [here](https://projects.theforeman.org/issues/32753), [here](https://github.com/theforeman/foreman/pull/8599), and [here](https://access.redhat.com/errata/RHSA-2022:5498).