Path Traversal in Theforeman Foreman

CVE-2014-4507

Directory traversal vulnerability in Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to overwrite arbitrary files via a .. (dot dot) in the dst parameter to tftp/fetch_boot_file.

Vulnerability class: Path Traversal (Directory Traversal)

EPSS: 0.024 (82.1th percentile) — read the EPSS interpretation.

Affected products

Theforeman Foreman — versions 1.4.0, 1.4.1, 1.4.2
N/a — versions n/a

Weakness classification (CWE)

CWE-22 — Path Traversal

References

cve@mitre.org (x_refsource_CONFIRM, Patch)