CVE-2016-3728

foreman: Missing input validation in Smart Proxy allows RCE via TFTP file variant parameter

Published May 20, 2016 CVSS 3.0 · 8.8 High EPSS 2.8% KEV · Not listed
Description
Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2016-4745 Eval injection vulnerability in tftp_api.rb in the TFTP module in the Smart-Proxy in Foreman before 1.10.4 and 1.11.x before 1.11.2 allows remote attackers to execute arbitrary code via the PXE template type portion of the PATH_INFO to tftp/.
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 12:03 AM
Reserved
Mar 30, 2016, 12:00 AM
Status
Modified
Published
May 20, 2016, 2:59 PM
Modified
Jun 17, 2026, 12:46 AM
Severity
Moderate
Public date
May 5, 2016, 12:00 AM