PT-2018-8398 · Red Hat · Cloudforms Management Engine

Adam Mariš · Publicado 2018-07-26 · Atualizado 2019-10-09 · CVE-2017-7530

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CloudForms Management Engine (cfme) versions prior to 5.7.3 CloudForms Management Engine (cfme) versions 5.8.x prior to 5.8.1

Description A missing privilege check was found in the CloudForms Management Engine when invoking arbitrary methods via filtering on VMs. This allows an attacker to execute actions they should not be allowed to, such as destroying VMs, by exploiting the MiqExpression execution triggered by API users.

Recommendations For CloudForms Management Engine (cfme) versions prior to 5.7.3, update to version 5.7.3 or later. For CloudForms Management Engine (cfme) versions 5.8.x prior to 5.8.1, update to version 5.8.1 or later.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2017-7530

RHSA-2017:1758

Produtos afetados

Cloudforms Management Engine

Referências · 5

• http://securityfocus.com/bid/100151 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-7530 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-7530 · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7530 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2017:1758 · Aviso do Fabricante