PT-2015-3930 · Red Hat · Red Hat Cloudforms

Published 2015-01-16 · Updated 2023-02-13 · CVE-2014-7814

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat CloudForms 3.1 Management Engine (CFME) version 5.3

Description The issue allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter. This can be achieved by sending a malicious request to specific API endpoints, although the exact endpoint is not specified. The general idea is that an attacker could manipulate the SQL filter to inject malicious SQL code, potentially leading to unauthorized data access or modification.

Recommendations For Red Hat CloudForms 3.1 Management Engine (CFME) version 5.3, consider restricting access to the REST API until a patch is available, and limit the ability to craft SQL filter requests to authorized and trusted users only. As a temporary workaround, consider implementing additional validation and sanitization for user-input data in SQL filters to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2014-7814

RHSA-2015:0028

Affected Products

Red Hat Cloudforms

References · 3

• http://rhn.redhat.com/errata/RHSA-2015-0028.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-7814 · Security Note
• http://secunia.com/advisories/62255 · Note