PT-2018-7161 · Red Hat · Cloudforms

Publicado

2018-07-27

·

Atualizado

2019-10-09

·

CVE-2017-2653

CVSS v3.1

6.5

Média

VetorAV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions: CloudForms versions prior to 5.7.2.1
Description: The issue allows an attacker to bypass the protect from forgery XSRF protection by accessing unused delete routes via GET requests, which could normally only be accessed via POST requests. This attack would require additional cross-site scripting or similar attacks in order to execute.
Recommendations: For versions prior to 5.7.2.1, update to version 5.7.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the unused delete routes to minimize the risk of exploitation.

Correção

RCE

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-2653
RHSA-2017:0898

Produtos afetados

Cloudforms