CVE-2017-7540

Published: Jul 21, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.

Affected (1)

Products: Safemode Project: Safemode

Safemode Project

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Safemode Project Safemode	Up to 1.3.2

Related CWEs

Incomplete List of Disallowed Inputs

The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete, leading to resultant weaknesses.

References (2)

https://github.com/svenfuchs/safemode/pull/23

Source: secalert@redhat.com

Issue Tracking

https://github.com/svenfuchs/safemode/pull/23

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

Timeline

No history available yet.