CVE-2021-3457

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

An improper authorization handling flaw was found in Foreman. The Shellhooks plugin for the smart-proxy allows Foreman clients to execute actions that should be limited to the Foreman Server. This flaw allows an authenticated local attacker to access and delete limited resources and also causes a denial of service on the Foreman server. The highest threat from this vulnerability is to integrity and system availability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: May 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-345707.5Multiple Phoenix Contact PLCnext control devices in versions prior to 2021.0.5 LTS are prone to a DoS attack through special crafted JSON re CVE-2021-345716.5Multiple Wireless M-Bus devices by Enbra use Hard-coded Credentials in Security mode 5 without an option to change the encryption key. An ad CVE-2021-345726.5Enbra EWM 1.7.29 does not check for or detect replay attacks sent by wireless M-Bus Security mode 5 devices. Instead timestamps of the senso CVE-2021-345735.5In Enbra EWM in Version 1.7.29 together with several tested wireless M-Bus Sensors the events backflow and "no flow" are not reconized or mi CVE-2021-345744.3In MB connect line mymbCONNECT24, mbCONNECT24 and Helmholz myREX24 and myREX24.virtual in all versions through v2.11.2 an authenticated atta CVE-2021-345757.5In MB connect line mymbCONNECT24, mbCONNECT24 in versions <= 2.8.0 an unauthenticated user can enumerate valid users by checking what kind o CVE-2021-345764.3In Kaden PICOFLUX Air in all known versions an information exposure through observable discrepancy exists. This may give sensitive informati CVE-2021-345776.5In the Kaden PICOFLUX AiR water meter an adversary can read the values through wireless M-Bus mode 5 with a hardcoded shared key while being CVE-2021-345788.1This vulnerability allows an attacker who has access to the WBM to read and write settings-parameters of the device by sending specifically CVE-2021-345797.5In Phoenix Contact: FL MGUARD DM version 1.12.0 and 1.13.0 access to the Apache web server being installed as part of the FL MGUARD DM on Mi CVE-2021-34584.6The Motorola MM1000 device configuration portal can be accessed without authentication, which could allow adapter settings to be modified.CVE-2021-345807.5In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the serve