CVE-2016-3728

CVSS V2 Medium 6.8 CVSS V3 High 8.8
Description
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.
Overview
  • CVE ID
  • CVE-2016-3728
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2016-05-20T14:59:04
  • Last Modified Date
  • 2023-02-12T23:20:09
Weakness Enumerations
CWE URL
CWE-284 http://cwe.mitre.org/data/definitions/284.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:theforeman:foreman:1.11.0:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:theforeman:foreman:1.11.0:rc1:*:*:*:*:*:* 1 OR
cpe:2.3:a:theforeman:foreman:1.11.0:rc2:*:*:*:*:*:* 1 OR
cpe:2.3:a:theforeman:foreman:1.11.0:rc3:*:*:*:*:*:* 1 OR
cpe:2.3:a:theforeman:foreman:1.11.1:*:*:*:*:*:*:* 1 OR
cpe:2.3:a:theforeman:foreman:1.10.3:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:M/Au:N/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • MEDIUM
  • Authentication
  • NONE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 6.8
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8.6
  • Impact Score
  • 6.4
CVSS Version 3
  • Version
  • 3.0
  • Vector String
  • CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • NONE
  • User Interaction
  • REQUIRED
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 8.8
  • Base Severity
  • HIGH
  • Exploitability Score
  • 2.8
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
http://projects.theforeman.org/issues/14931
http://theforeman.org/security.html#2016-3728 Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/05/19/2
https://access.redhat.com/errata/RHBA-2016:1501
https://access.redhat.com/security/cve/CVE-2016-3728
https://bugzilla.redhat.com/show_bug.cgi?id=1333378
https://github.com/theforeman/smart-proxy/commit/eef532aa668d656b9d61d9c6edf7c2505f3f43c7
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2016-3728
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3728
History
Created Old Value New Value Data Type Notes
2022-05-10 18:52:29 Added to TrackCVE
2022-12-02 09:37:18 2016-05-20T14:59Z 2016-05-20T14:59:04 CVE Published Date updated
2022-12-02 09:37:18 2018-01-05T02:30:43 CVE Modified Date updated
2022-12-02 09:37:18 Modified Vulnerability Status updated
2023-02-02 22:06:12 2023-02-02T21:16:54 CVE Modified Date updated
2023-02-02 22:06:13 Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/. It was found that the “variant” parameter in the TFTP API of Foreman was passed to the eval() function. An attacker could possibly use this flaw to execute arbitrary code with the privileges of the Foreman user. Description updated
2023-02-02 22:06:17 References updated
2023-02-13 00:05:44 2023-02-12T23:20:09 CVE Modified Date updated
2023-02-13 00:05:45 It was found that the “variant” parameter in the TFTP API of Foreman was passed to the eval() function. An attacker could possibly use this flaw to execute arbitrary code with the privileges of the Foreman user. Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/. Description updated