Foreman: os command injection via ct_location and fcct_location parameters (The Foreman Foreman)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.73 % · percentile 54 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- redhat
- NVD status
- Deferred
Description
A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
References
- https://access.redhat.com/errata/RHSA-2025:19721
- https://access.redhat.com/errata/RHSA-2025:19832
- https://access.redhat.com/errata/RHSA-2025:19855
- https://access.redhat.com/errata/RHSA-2025:19856
- https://access.redhat.com/security/cve/CVE-2025-10622
- https://bugzilla.redhat.com/show_bug.cgi?id=2396020
- https://theforeman.org/security.html#2025-10622
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | redhat |
| CVSS 3.1 | HIGH 8.0 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · secalert@redhat.com (Secondary) |
European references
- ENISA EUVD · EUVD-2025-37786
- GCVE · GCVE-0-2025-10622
Affected products
| Product | Versions |
|---|---|
| The Foreman · Foreman | affected 3.12.0 < 3.16.1 |
| Red Hat · Red Hat Satellite 6.15 for RHEL 8 | unaffected 0:3.9.1.13-1.el8sat < * |
| Red Hat · Red Hat Satellite 6.16 for RHEL 8 | unaffected 0:3.12.0.11-1.el8sat < * |
| Red Hat · Red Hat Satellite 6.16 for RHEL 9 | unaffected 0:3.12.0.11-1.el9sat < * |
| Red Hat · Red Hat Satellite 6.17 for RHEL 9 | unaffected 0:3.14.0.10-1.el9sat < * |
| Red Hat · Red Hat Satellite 6.18 for RHEL 9 | unaffected 0:3.16.0.4-1.el9sat < * |
| Red Hat · Red Hat Satellite 6 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |