CVE-2013-2121 Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary co...

MediumCVSS 6.0 EPSS 24.8% Framework module Public exploit

Published: 2013-07-31 13:00
Updated: 2026-06-17 02:52
Exploit status: Public exploit available

Description

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

Affected products

Product	Affected versions	Fixed in
redhat openstack	= 3.0	No fix listed
theforeman foreman	<= 1.2.0	No fix listed
theforeman foreman	= 1.1	No fix listed

References

CVSS v2.0

6.0 Medium

AV:N/AC:M/Au:S/C:P/I:P/A:P

Access Vector: Network
Access Complexity: Medium
Authentication: Single
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Weakness & likelihood

EPSS (exploitation probability, 30 days): 24.78% (percentile 97.9)
CWE: CWE-94

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection Framework module · Metasploit Framework (Rapid7) · 2013-06-06
Foreman (RedHat OpenStack/Satellite) - bookmarks/create Code Injection (Metasploit) Exploit · Exploit Database (OffSec) · 2013-07-23