Name of the Vulnerable Software and Affected Versions:
Foreman versions prior to 2.4.1
Foreman versions prior to 2.5.1
Foreman versions prior to 3.0.0
Description:
A server-side remote code execution issue was found in the Foreman project. An authenticated attacker could use Sendmail configuration options to overwrite the defaults and perform command injection. The highest threat from this issue is to confidentiality, integrity, and availability of the system.
Recommendations:
For versions prior to 2.4.1, update to version 2.4.1 or later.
For versions prior to 2.5.1, update to version 2.5.1 or later.
For versions prior to 3.0.0, update to version 3.0.0 or later.
As a temporary workaround, consider restricting access to Sendmail configuration options to minimize the risk of exploitation.