CVE-2014-0007

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute...

7.5 HighPublic exploitFix available

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

Exploit likelihood

9.02%Up 1.4 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

Record: CVE-2014-0007
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Updated: 2026-11-02

CVE List No score

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

Record: CVE-2014-0007
Updated: 2026-11-02

EUVDEUVD-2014-0111 No score

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

Record: EUVD-2014-0111
Updated: 2026-11-03

GitHub AdvisoriesGHSA-4ffx-rh24-gpxh No score

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute...

The Smart-Proxy in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the path parameter to tftp/fetch_boot_file.

Record: GHSA-4ffx-rh24-gpxh
Updated: 2026-11-02

Affected products

theforeman foreman

Affected packages

Affected packages
Package	Affected	Fixed
`libmongodb` Red Hat:satellite_capsule:6.0::el6	before 0:2.4.6-2.el6sat	0:2.4.6-2.el6sat
`mongodb` Red Hat:satellite_capsule:6.0::el6	before 0:2.4.6-2.el6sat	0:2.4.6-2.el6sat
`mongodb-debuginfo` Red Hat:satellite_capsule:6.0::el6	before 0:2.4.6-2.el6sat	0:2.4.6-2.el6sat
`mongodb-server` Red Hat:satellite_capsule:6.0::el6	before 0:2.4.6-2.el6sat	0:2.4.6-2.el6sat
`libmongodb` Red Hat:satellite:6.0::el6	before 0:2.4.6-2.el6sat	0:2.4.6-2.el6sat
`mongodb` Red Hat:satellite:6.0::el6	before 0:2.4.6-2.el6sat	0:2.4.6-2.el6sat
`mongodb-debuginfo` Red Hat:satellite:6.0::el6	before 0:2.4.6-2.el6sat	0:2.4.6-2.el6sat
`mongodb-server` Red Hat:satellite:6.0::el6	before 0:2.4.6-2.el6sat	0:2.4.6-2.el6sat
`mongodb` Red Hat:satellite_capsule:6.0::el7	before 0:2.4.9-3.el7sat	0:2.4.9-3.el7sat
`mongodb-debuginfo` Red Hat:satellite_capsule:6.0::el7	before 0:2.4.9-3.el7sat	0:2.4.9-3.el7sat

Show 58 moreShow less

Affected packages
Package	Affected	Fixed
`mongodb-server` Red Hat:satellite_capsule:6.0::el7	before 0:2.4.9-3.el7sat	0:2.4.9-3.el7sat
`mongodb` Red Hat:satellite:6.0::el7	before 0:2.4.9-3.el7sat	0:2.4.9-3.el7sat
`mongodb-debuginfo` Red Hat:satellite:6.0::el7	before 0:2.4.9-3.el7sat	0:2.4.9-3.el7sat
`mongodb-server` Red Hat:satellite:6.0::el7	before 0:2.4.9-3.el7sat	0:2.4.9-3.el7sat
`katello` Red Hat:satellite:6.0::el6	before 0:1.5.0-30.el6sat	0:1.5.0-30.el6sat
`katello` Red Hat:satellite:6.0::el7	before 0:1.5.0-30.el7sat	0:1.5.0-30.el7sat
`foreman` Red Hat:satellite:6.0::el6	before 0:1.6.0.44-1.el6sat	0:1.6.0.44-1.el6sat
`foreman-compute` Red Hat:satellite:6.0::el6	before 0:1.6.0.44-1.el6sat	0:1.6.0.44-1.el6sat
`foreman-gce` Red Hat:satellite:6.0::el6	before 0:1.6.0.44-1.el6sat	0:1.6.0.44-1.el6sat
`foreman-libvirt` Red Hat:satellite:6.0::el6	before 0:1.6.0.44-1.el6sat	0:1.6.0.44-1.el6sat
`foreman-ovirt` Red Hat:satellite:6.0::el6	before 0:1.6.0.44-1.el6sat	0:1.6.0.44-1.el6sat
`foreman-postgresql` Red Hat:satellite:6.0::el6	before 0:1.6.0.44-1.el6sat	0:1.6.0.44-1.el6sat
`foreman-vmware` Red Hat:satellite:6.0::el6	before 0:1.6.0.44-1.el6sat	0:1.6.0.44-1.el6sat
`foreman` Red Hat:satellite:6.0::el7	before 0:1.6.0.44-1.el7sat	0:1.6.0.44-1.el7sat
`foreman-compute` Red Hat:satellite:6.0::el7	before 0:1.6.0.44-1.el7sat	0:1.6.0.44-1.el7sat
`foreman-gce` Red Hat:satellite:6.0::el7	before 0:1.6.0.44-1.el7sat	0:1.6.0.44-1.el7sat
`foreman-libvirt` Red Hat:satellite:6.0::el7	before 0:1.6.0.44-1.el7sat	0:1.6.0.44-1.el7sat
`foreman-ovirt` Red Hat:satellite:6.0::el7	before 0:1.6.0.44-1.el7sat	0:1.6.0.44-1.el7sat
`foreman-postgresql` Red Hat:satellite:6.0::el7	before 0:1.6.0.44-1.el7sat	0:1.6.0.44-1.el7sat
`foreman-vmware` Red Hat:satellite:6.0::el7	before 0:1.6.0.44-1.el7sat	0:1.6.0.44-1.el7sat
`v8` Red Hat:satellite_capsule:6.0::el6	before 1:3.14.5.10-9.el6sat	1:3.14.5.10-9.el6sat
`v8-debuginfo` Red Hat:satellite_capsule:6.0::el6	before 1:3.14.5.10-9.el6sat	1:3.14.5.10-9.el6sat
`v8` Red Hat:satellite:6.0::el6	before 1:3.14.5.10-9.el6sat	1:3.14.5.10-9.el6sat
`v8-debuginfo` Red Hat:satellite:6.0::el6	before 1:3.14.5.10-9.el6sat	1:3.14.5.10-9.el6sat
`v8` Red Hat:satellite_capsule:6.0::el7	before 1:3.14.5.10-11.el7sat	1:3.14.5.10-11.el7sat
`v8-debuginfo` Red Hat:satellite_capsule:6.0::el7	before 1:3.14.5.10-11.el7sat	1:3.14.5.10-11.el7sat
`v8` Red Hat:satellite:6.0::el7	before 1:3.14.5.10-11.el7sat	1:3.14.5.10-11.el7sat
`v8-debuginfo` Red Hat:satellite:6.0::el7	before 1:3.14.5.10-11.el7sat	1:3.14.5.10-11.el7sat
`python-httplib2` Red Hat:satellite_capsule:6.0::el6	before 0:0.7.2-1.el6	0:0.7.2-1.el6
`python-httplib2` Red Hat:satellite:6.0::el6	before 0:0.7.2-1.el6	0:0.7.2-1.el6
`python-httplib2` Red Hat:satellite_capsule:6.0::el7	before 0:0.6.0-6.el7sat	0:0.6.0-6.el7sat
`python-httplib2` Red Hat:satellite:6.0::el7	before 0:0.6.0-6.el7sat	0:0.6.0-6.el7sat
`foreman-proxy` Red Hat:satellite_capsule:6.0::el6	before 0:1.6.0.30-1.el6sat	0:1.6.0.30-1.el6sat
`foreman-proxy` Red Hat:satellite:6.0::el6	before 0:1.6.0.30-1.el6sat	0:1.6.0.30-1.el6sat
`foreman-proxy` Red Hat:satellite_capsule:6.0::el7	before 0:1.6.0.30-1.el7sat	0:1.6.0.30-1.el7sat
`foreman-proxy` Red Hat:satellite:6.0::el7	before 0:1.6.0.30-1.el7sat	0:1.6.0.30-1.el7sat
`rubygem-kafo` Red Hat:satellite_capsule:6.0::el6	before 0:0.6.4-2.el6sat	0:0.6.4-2.el6sat
`rubygem-kafo_parsers` Red Hat:satellite_capsule:6.0::el6	before 0:0.0.3-2.el6sat	0:0.0.3-2.el6sat
`rubygem-kafo` Red Hat:satellite:6.0::el6	before 0:0.6.4-2.el6sat	0:0.6.4-2.el6sat
`rubygem-kafo_parsers` Red Hat:satellite:6.0::el6	before 0:0.0.3-2.el6sat	0:0.0.3-2.el6sat
`rubygem-kafo` Red Hat:satellite_capsule:6.0::el7	before 0:0.6.4-2.el7sat	0:0.6.4-2.el7sat
`rubygem-kafo_parsers` Red Hat:satellite_capsule:6.0::el7	before 0:0.0.3-2.el7sat	0:0.0.3-2.el7sat
`rubygem-kafo` Red Hat:satellite:6.0::el7	before 0:0.6.4-2.el7sat	0:0.6.4-2.el7sat
`rubygem-kafo_parsers` Red Hat:satellite:6.0::el7	before 0:0.0.3-2.el7sat	0:0.0.3-2.el7sat
`rubygem-hammer_cli_foreman` Red Hat:satellite:6.0::el6	before 0:0.1.1-16.el6sat	0:0.1.1-16.el6sat
`rubygem-hammer_cli_foreman_tasks` Red Hat:satellite:6.0::el6	before 0:0.0.3-3.el6sat	0:0.0.3-3.el6sat
`rubygem-hammer_cli_foreman` Red Hat:satellite:6.0::el7	before 0:0.1.1-16.el7sat	0:0.1.1-16.el7sat
`rubygem-hammer_cli_foreman_tasks` Red Hat:satellite:6.0::el7	before 0:0.0.3-3.el7sat	0:0.0.3-3.el7sat
`python-anyjson` Red Hat:satellite_capsule:6.0::el6	before 0:0.3.3-4.el6sat	0:0.3.3-4.el6sat
`python-anyjson` Red Hat:satellite:6.0::el6	before 0:0.3.3-4.el6sat	0:0.3.3-4.el6sat
`python-anyjson` Red Hat:satellite_capsule:6.0::el7	before 0:0.3.3-5.el7sat	0:0.3.3-5.el7sat
`python-simplejson` Red Hat:satellite_capsule:6.0::el7	before 0:3.2.0-1.el7sat	0:3.2.0-1.el7sat
`python-simplejson-debuginfo` Red Hat:satellite_capsule:6.0::el7	before 0:3.2.0-1.el7sat	0:3.2.0-1.el7sat
`python-anyjson` Red Hat:satellite:6.0::el7	before 0:0.3.3-5.el7sat	0:0.3.3-5.el7sat
`python-simplejson` Red Hat:satellite:6.0::el7	before 0:3.2.0-1.el7sat	0:3.2.0-1.el7sat
`python-simplejson-debuginfo` Red Hat:satellite:6.0::el7	before 0:3.2.0-1.el7sat	0:3.2.0-1.el7sat
`ruby193-foreman-proxy` Red Hat:openstack:3::el6	before 0:1.1.10001-7.el6ost	0:1.1.10001-7.el6ost
`foreman-proxy` Red Hat:openstack:4::el6	before 0:1.3.0-5.el6sat	0:1.3.0-5.el6sat

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Foreman Smart-Proxy - Remote Command Injection	2014-06-05

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-0007 is a high vulnerability (CVSS 7.5) in Theforeman Foreman, published June 20, 2014. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.02%, the 95th percentile. Fixed in libmongodb 0:2.4.6-2.el6sat.

References

Show 101 moreShow less