PT-2018-7167 · Red Hat · Cloudforms Management Engine

Publicado 2018-07-26 · Atualizado 2019-10-09 · CVE-2017-2664

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: CloudForms Management Engine (cfme) versions prior to 5.7.3 CloudForms Management Engine (cfme) versions 5.8.x prior to 5.8.1

Description: The issue is related to a lack of Role-Based Access Control (RBAC) controls on certain methods within the rails application portion of CloudForms. This could allow an attacker with access to use various methods to escalate privileges.

Recommendations: For CloudForms Management Engine (cfme) versions prior to 5.7.3, update to version 5.7.3 or later. For CloudForms Management Engine (cfme) versions 5.8.x prior to 5.8.1, update to version 5.8.1 or later.

Correção

Improper Access Control

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2017-2664

RHSA-2017:1758

RHSA-2017:3484

Produtos afetados

Cloudforms Management Engine

Referências · 6

• https://osv.dev/vulnerability/CVE-2017-2664 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:3484 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2664 · Aviso do Fabricante
• http://securityfocus.com/bid/100148 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-2664 · Nota de Segurança
• https://access.redhat.com/errata/RHSA-2017:1758 · Aviso do Fabricante