CVSS 3.0
9.8 criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2018-14643
An authentication bypass flaw was found in the smart_proxy_dynflow component used by Foreman. A malicious attacker can use this flaw to remotely execute arbitrary commands on machines managed by vulnerable Foreman instances, in a highly privileged context.
Severity
- EPSS
- 6.2% chance of exploitation in the next 30 days; higher than 93% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-592, CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- theforeman:foreman
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-gx5g-xcxj-cx2w | RubyGems | smart_proxy_dynflow | >=0.2.0 <0.2.1 | 0.2.1 |
| GHSA-gx5g-xcxj-cx2w | RubyGems | smart_proxy_dynflow | <0.1.11 | 0.1.11 |