Vulnerabilities > CVE-2017-7540 - Unspecified vulnerability in Safemode Project Safemode

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

safemode-project

critical

NVD

Published: 2017-07-21

Updated: 2019-10-09

Summary

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Vulnerable Configurations

Part	Description	Count
Application	Safemode_Project Safemode Project Safemode 0.0.1 Safemode Project Safemode 0.0.2 Safemode Project Safemode 1.0.0 Safemode Project Safemode 1.0.1 Safemode Project Safemode 1.0.2 Safemode Project Safemode 1.1.0 Safemode Project Safemode 1.2.0 Safemode Project Safemode 1.2.1 Safemode Project Safemode 1.2.2 Safemode Project Safemode 1.2.3 Safemode Project Safemode 1.2.4 Safemode Project Safemode 1.2.5 Safemode Project Safemode 1.3.1 Safemode Project Safemode 1.3.2	14

References

https://github.com/svenfuchs/safemode/pull/23