Vulnerabilities > CVE-2017-7540 - Unspecified vulnerability in Safemode Project Safemode

CVSS 7.5 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

PARTIAL

Integrity impact

PARTIAL

Availability impact

PARTIAL

network

low complexity

safemode-project

NVD

Published: 2017-07-21

Updated: 2019-10-09

Summary

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Vulnerable Configurations

Part	Description	Count
Application	Safemode_Project Safemode Project Safemode 0.0.1 Safemode Project Safemode 0.0.2 Safemode Project Safemode 1.0.0 Safemode Project Safemode 1.0.1 Safemode Project Safemode 1.0.2 Safemode Project Safemode 1.1.0 Safemode Project Safemode 1.2.0 Safemode Project Safemode 1.2.1 Safemode Project Safemode 1.2.2 Safemode Project Safemode 1.2.3 Safemode Project Safemode 1.2.4 Safemode Project Safemode 1.2.5 Safemode Project Safemode 1.3.1 Safemode Project Safemode 1.3.2	14

References

https://github.com/svenfuchs/safemode/pull/23