PT-2018-4977 · Red Hat · Cloudforms

Felix Dewaleyne · Publicado 2018-09-10 · Atualizado 2019-10-09 · CVE-2016-7071

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CloudForms versions prior to 5.6.2.2 CloudForms versions prior to 5.7.0.7

Description The issue is related to improper application of permissions controls to VM IDs passed by users. A remote, authenticated attacker could exploit this to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.

Recommendations For versions prior to 5.6.2.2, update to version 5.6.2.2 or later. For versions prior to 5.7.0.7, update to version 5.7.0.7 or later.

Correção

Improper Authorization

Enumeração de Fraquezas

CWE-285

Identificadores relacionados

CVE-2016-7071

RHSA-2016:2091

Produtos afetados

Cloudforms

Referências · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7071 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7071 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-7071 · Aviso do Fabricante
• http://rhn.redhat.com/errata/RHSA-2016-2091.html · Aviso do Fabricante