CyberRota Analysis
AI-GeneratedThe foreman-tail utility in Foreman is susceptible to OS command injection due to improper handling of user-supplied arguments with the eval command, allowing local attackers to execute arbitrary system commands. This vulnerability poses a medium risk as it can lead to unauthorized access or control over the affected system. Organizations using Foreman should prioritize addressing this issue to mitigate potential exploitation risks.
Original NVD Description
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand file paths. Because the input is not sanitized or quoted, a local attacker can inject shell metacharacters (e.g., ;, &, |) to execute arbitrary system commands.
Related CVEs
Other vulnerabilities affecting the same vendor(s)