SQL Injection in Theforeman Foreman

CVE-2013-4386

Multiple SQL injection vulnerabilities in app/models/concerns/host_common.rb in Foreman before 1.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) fqdn or (2) hostgroup parameter.

Vulnerability class: SQL Injection

EPSS: 0.012 (66.2th percentile) — read the EPSS interpretation.

Affected products

Theforeman Foreman — versions 1.2.0, 1.2.1
Redhat Openstack — versions 3.0
N/a — versions n/a

Weakness classification (CWE)

CWE-89 — SQL Injection

References

secalert@redhat.com (x_refsource_CONFIRM)
secalert@redhat.com (x_refsource_CONFIRM, Patch)
secalert@redhat.com (x_refsource_REDHAT, vendor-advisory)