PT-2019-8017 · Red Hat · Cloudforms

Hacked0X90 · Publicado 2019-06-12 · Atualizado 2019-07-17 · CVE-2017-15123

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CloudForms versions 5.8 through 5.10

Description A flaw was found in the CloudForms web interface where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms, including data such as newly created virtual machines.

Recommendations For CloudForms versions 5.8 through 5.10, restrict access to the RSS feed URLs to authenticated users only to prevent unauthorized viewing of sensitive information. As a temporary workaround, consider disabling the RSS feed feature until a patch is available.

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2017-15123

Produtos afetados

Cloudforms

Referências · 6

• https://t.me/cibsecurity/4870 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2017-15123 · Aviso do Fabricante
• https://hacked0x90.wordpress.com/2019/07/17/cve-2017-15123-exploit · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-15123 · Nota de Segurança
• http://securityfocus.com/bid/108690 · Nota