PT-2018-4977 · Red Hat · Cloudforms

Felix Dewaleyne · Published 2018-09-10 · Updated 2019-10-09 · CVE-2016-7071

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions CloudForms versions prior to 5.6.2.2 CloudForms versions prior to 5.7.0.7

Description The issue is related to improper application of permissions controls to VM IDs passed by users. A remote, authenticated attacker could exploit this to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.

Recommendations For versions prior to 5.6.2.2, update to version 5.6.2.2 or later. For versions prior to 5.7.0.7, update to version 5.7.0.7 or later.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2016-7071

RHSA-2016:2091

Affected Products

Cloudforms

References · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7071 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7071 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7071 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2016-2091.html · Vendor Advisory