CVEvulnerability

CVE-2017-7540

9.8 CRITICAL Published 2017-07-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-07-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-184

Description

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Affected configurations

• safemode project safemode (<= 1.3.2)

Related

Weakness · CWE (1)

  • CWE-184 Incomplete List of Disallowed Inputs weakness

References