« Volver al listado

CVE-2025-2157

Estado: AplazadaBaja (3.3)—

A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Redhat — SatelliteAITheforeman — ForemanAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-2157",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-2157",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-03-17T16:53:06.559411Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.3,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "Red Hat",
          "product": "Satellite Server",
          "versions": [
            {
              "status": "affected",
              "version": "6.16",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "6.17",
              "versionType": "semver"
            }
          ],
          "packageName": "foreman",
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Satellite 6",
          "packageName": "foreman",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2025-03-15T07:15:34.930",
  "references": [
    {
      "url": "https://access.redhat.com/security/cve/CVE-2025-2157",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2351092",
      "source": "secalert@redhat.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-922"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in Foreman/Red Hat Satellite. Improper file permissions allow low-privileged OS users to monitor and access temporary files under /var/tmp, exposing sensitive command outputs, such as /etc/shadow. This issue can lead to information disclosure and privilege escalation if exploited effectively."
    },
    {
      "lang": "es",
      "value": "Se encontró una falla en Foreman/Red Hat Satellite. Los permisos de archivo incorrectos permiten a usuarios del sistema operativo con pocos privilegios supervisar y acceder a archivos temporales en /var/tmp, exponiendo así salidas de comandos confidenciales, como /etc/shadow. Este problema puede provocar la divulgación de información y la escalada de privilegios si se explota correctamente."
    }
  ],
  "lastModified": "2026-06-17T09:06:26.193",
  "sourceIdentifier": "secalert@redhat.com"
}