Every CVE Search/ Get API key

CVE-2013-2121

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1...

6.0 MediumPublic exploit

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

Exploit likelihood

24.8%Down 41.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 6.0

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

Record
CVE-2013-2121
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-94
Updated
2026-11-02
CVE List No score

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

Record
CVE-2013-2121
Updated
2026-11-02
EUVDEUVD-2013-2089 No score

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

Record
EUVD-2013-2089
Updated
2026-11-03
GitHub AdvisoriesGHSA-j6g9-xm4c-vp6v No score

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1...

Eval injection vulnerability in the create method in the Bookmarks controller in Foreman before 1.2.0-RC2 allows remote authenticated users with permissions to create bookmarks to execute arbitrary code via a controller name attribute.

Record
GHSA-j6g9-xm4c-vp6v
Weakness
CWE-94
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
libmongodb
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:2.4.6-2.el6sat
0:2.4.6-2.el6sat
mongodb
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:2.4.6-2.el6sat
0:2.4.6-2.el6sat
mongodb-debuginfo
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:2.4.6-2.el6sat
0:2.4.6-2.el6sat
mongodb-server
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:2.4.6-2.el6sat
0:2.4.6-2.el6sat
libmongodb
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:2.4.6-2.el6sat
0:2.4.6-2.el6sat
mongodb
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:2.4.6-2.el6sat
0:2.4.6-2.el6sat
mongodb-debuginfo
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:2.4.6-2.el6sat
0:2.4.6-2.el6sat
mongodb-server
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:2.4.6-2.el6sat
0:2.4.6-2.el6sat
mongodb
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:2.4.9-3.el7sat
0:2.4.9-3.el7sat
mongodb-debuginfo
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:2.4.9-3.el7sat
0:2.4.9-3.el7sat
Show 69 moreShow less
Affected packages
PackageAffectedFixed
mongodb-server
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:2.4.9-3.el7sat
0:2.4.9-3.el7sat
mongodb
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:2.4.9-3.el7sat
0:2.4.9-3.el7sat
mongodb-debuginfo
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:2.4.9-3.el7sat
0:2.4.9-3.el7sat
mongodb-server
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:2.4.9-3.el7sat
0:2.4.9-3.el7sat
katello
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.5.0-30.el6sat
0:1.5.0-30.el6sat
katello
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.5.0-30.el7sat
0:1.5.0-30.el7sat
foreman
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el6sat
0:1.6.0.44-1.el6sat
foreman-compute
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el6sat
0:1.6.0.44-1.el6sat
foreman-gce
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el6sat
0:1.6.0.44-1.el6sat
foreman-libvirt
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el6sat
0:1.6.0.44-1.el6sat
foreman-ovirt
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el6sat
0:1.6.0.44-1.el6sat
foreman-postgresql
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el6sat
0:1.6.0.44-1.el6sat
foreman-vmware
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el6sat
0:1.6.0.44-1.el6sat
foreman
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el7sat
0:1.6.0.44-1.el7sat
foreman-compute
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el7sat
0:1.6.0.44-1.el7sat
foreman-gce
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el7sat
0:1.6.0.44-1.el7sat
foreman-libvirt
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el7sat
0:1.6.0.44-1.el7sat
foreman-ovirt
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el7sat
0:1.6.0.44-1.el7sat
foreman-postgresql
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el7sat
0:1.6.0.44-1.el7sat
foreman-vmware
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.44-1.el7sat
0:1.6.0.44-1.el7sat
v8
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 1:3.14.5.10-9.el6sat
1:3.14.5.10-9.el6sat
v8-debuginfo
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 1:3.14.5.10-9.el6sat
1:3.14.5.10-9.el6sat
v8
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 1:3.14.5.10-9.el6sat
1:3.14.5.10-9.el6sat
v8-debuginfo
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 1:3.14.5.10-9.el6sat
1:3.14.5.10-9.el6sat
v8
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 1:3.14.5.10-11.el7sat
1:3.14.5.10-11.el7sat
v8-debuginfo
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 1:3.14.5.10-11.el7sat
1:3.14.5.10-11.el7sat
v8
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 1:3.14.5.10-11.el7sat
1:3.14.5.10-11.el7sat
v8-debuginfo
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 1:3.14.5.10-11.el7sat
1:3.14.5.10-11.el7sat
python-httplib2
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.7.2-1.el6
0:0.7.2-1.el6
python-httplib2
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.7.2-1.el6
0:0.7.2-1.el6
python-httplib2
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.6.0-6.el7sat
0:0.6.0-6.el7sat
python-httplib2
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.6.0-6.el7sat
0:0.6.0-6.el7sat
foreman-proxy
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.30-1.el6sat
0:1.6.0.30-1.el6sat
foreman-proxy
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:1.6.0.30-1.el6sat
0:1.6.0.30-1.el6sat
foreman-proxy
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.30-1.el7sat
0:1.6.0.30-1.el7sat
foreman-proxy
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:1.6.0.30-1.el7sat
0:1.6.0.30-1.el7sat
rubygem-kafo
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.6.4-2.el6sat
0:0.6.4-2.el6sat
rubygem-kafo_parsers
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.0.3-2.el6sat
0:0.0.3-2.el6sat
rubygem-kafo
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.6.4-2.el6sat
0:0.6.4-2.el6sat
rubygem-kafo_parsers
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.0.3-2.el6sat
0:0.0.3-2.el6sat
rubygem-kafo
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.6.4-2.el7sat
0:0.6.4-2.el7sat
rubygem-kafo_parsers
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.0.3-2.el7sat
0:0.0.3-2.el7sat
rubygem-kafo
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.6.4-2.el7sat
0:0.6.4-2.el7sat
rubygem-kafo_parsers
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.0.3-2.el7sat
0:0.0.3-2.el7sat
rubygem-hammer_cli_foreman
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.1.1-16.el6sat
0:0.1.1-16.el6sat
rubygem-hammer_cli_foreman_tasks
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.0.3-3.el6sat
0:0.0.3-3.el6sat
rubygem-hammer_cli_foreman
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.1.1-16.el7sat
0:0.1.1-16.el7sat
rubygem-hammer_cli_foreman_tasks
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.0.3-3.el7sat
0:0.0.3-3.el7sat
python-anyjson
Red Hat:satellite_capsule:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.3.3-4.el6sat
0:0.3.3-4.el6sat
python-anyjson
Red Hat:satellite:6.0::el6
From an advisory covering 24 CVEs
 before 0:0.3.3-4.el6sat
0:0.3.3-4.el6sat
python-anyjson
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.3.3-5.el7sat
0:0.3.3-5.el7sat
python-simplejson
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:3.2.0-1.el7sat
0:3.2.0-1.el7sat
python-simplejson-debuginfo
Red Hat:satellite_capsule:6.0::el7
From an advisory covering 24 CVEs
 before 0:3.2.0-1.el7sat
0:3.2.0-1.el7sat
python-anyjson
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:0.3.3-5.el7sat
0:0.3.3-5.el7sat
python-simplejson
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:3.2.0-1.el7sat
0:3.2.0-1.el7sat
python-simplejson-debuginfo
Red Hat:satellite:6.0::el7
From an advisory covering 24 CVEs
 before 0:3.2.0-1.el7sat
0:3.2.0-1.el7sat
ruby193-foreman
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.1.10009-3.el6ost
0:1.1.10009-3.el6ost
ruby193-foreman-mysql
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.1.10009-3.el6ost
0:1.1.10009-3.el6ost
ruby193-foreman-proxy
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.1.10001-4.el6ost
0:1.1.10001-4.el6ost
ruby193-openstack-foreman-installer
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:0.0.18-1.el6ost
0:0.0.18-1.el6ost
ruby193-openstack-foreman-installer-debuginfo
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:0.0.18-1.el6ost
0:0.0.18-1.el6ost
ruby193-rubygem-ancestry
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.3.0-5.el6ost
0:1.3.0-5.el6ost
ruby193-rubygem-ancestry-doc
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.3.0-5.el6ost
0:1.3.0-5.el6ost
ruby193-rubygem-fog
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.10.1-11.el6ost
0:1.10.1-11.el6ost
ruby193-rubygem-fog-doc
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.10.1-11.el6ost
0:1.10.1-11.el6ost
ruby193-rubygem-mysql
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:2.8.1-4.el6ost
0:2.8.1-4.el6ost
ruby193-rubygem-mysql-debuginfo
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:2.8.1-4.el6ost
0:2.8.1-4.el6ost
ruby193-rubygem-safemode
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.2.0-9.el6ost
0:1.2.0-9.el6ost
ruby193-rubygem-safemode-doc
Red Hat:openstack:3::el6
From an advisory covering 2 CVEs
 before 0:1.2.0-9.el6ost
0:1.2.0-9.el6ost

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
MetasploitForeman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection2013-06-06
Exploit-DBForeman (RedHat OpenStack/Satellite) - bookmarks/create Code Injection (Metasploit)2013-07-23

History

History
RecordedChangedSources
affected, exploits, facts
aliasesEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2013-2121 is a medium vulnerability (CVSS 6.0) in Theforeman Foreman, published July 31, 2013. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.8%, the 97th percentile. No source names a fixed version.

References

Show 113 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open