PT-2018-5381 · Red Hat · Cloudforms

Published 2018-02-28 · Updated 2023-02-12 · CVE-2017-12191

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions CloudForms (affected versions not specified)

Description A flaw was found in the CloudForms account configuration when using VMware, where a shared account with privileged access to VMRC functions is used by default. This could allow an attacker to view and make changes to settings in the VMRC and virtual machines that they should not have access to.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Insufficient Session Expiration

Weakness Enumeration

CWE-284

CWE-613

Related Identifiers

CVE-2017-12191

RHSA-2018:0374

Affected Products

Cloudforms

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-12191 · Security Note
• https://access.redhat.com/errata/RHSA-2018:0374 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-12191 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1500517 · Vendor Advisory