CVE-2017-7540
Last modified
CVE-2017-7540 is a vulnerability of currently unknown severity. rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.. EPSS estimates a 1.63% chance of exploitation in the next 30 days.
Description
rubygem-safemode, as used in Foreman, versions 1.3.2 and earlier are vulnerable to bypassing safe mode limitations via special Ruby syntax. This can lead to deletion of objects for which the user does not have delete permissions or possibly to privilege escalation.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Safemode Project | Safemode | <= 1.3.2 |
References
- https://github.com/svenfuchs/safemode/pull/23Issue Tracking
- https://github.com/svenfuchs/safemode/pull/23Issue Tracking
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-7540?
How severe is CVE-2017-7540?
How do I fix CVE-2017-7540?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-7534OpenShift Enterprise version 3.x is vulnerable to a stored X…
- CVE-2017-7535foreman before version 1.16.0 is vulnerable to a stored XSS …6.1
- CVE-2017-7536In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and …7
- CVE-2017-7537It was found that a mock CMC authentication plugin with a ha…5.9
- CVE-2017-7538A cross-site scripting (XSS) flaw was found in how an organi…3.5
- CVE-2017-7539An assertion-failure flaw was found in Qemu before 2.10.1, i…5.3
- CVE-2017-7541The brcmf_cfg80211_mgmt_tx function in drivers/net/wireless/…7.8
- CVE-2017-7542The ip6_find_1stfragopt function in net/ipv6/output_core.c i…
- CVE-2017-7543A race-condition flaw was discovered in openstack-neutron be…5.3
- CVE-2017-7544libexif through 0.6.21 is vulnerable to out-of-bounds heap r…
- CVE-2017-7545It was discovered that the XmlUtils class in jbpmmigration 6…6.5
- CVE-2017-7546PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and…
Are you affected by CVE-2017-7540?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST