PT-2018-5381 · Red Hat · Cloudforms

CVE-2017-12191 · Publicado 2018-02-28 · Atualizado 2023-02-12

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CloudForms (affected versions not specified)

Description A flaw was found in the CloudForms account configuration when using VMware, where a shared account with privileged access to VMRC functions is used by default. This could allow an attacker to view and make changes to settings in the VMRC and virtual machines that they should not have access to.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-284

CWE-613

Identificadores relacionados

CVE-2017-12191

RHSA-2018:0374

Produtos afetados

Cloudforms

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12191 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2018:0374 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-12191 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=1500517 · Aviso do Fabricante