PT-2018-7161 · Red Hat · Cloudforms

Published 2018-07-27 · Updated 2019-10-09 · CVE-2017-2653

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: CloudForms versions prior to 5.7.2.1

Description: The issue allows an attacker to bypass the protect from forgery XSRF protection by accessing unused delete routes via GET requests, which could normally only be accessed via POST requests. This attack would require additional cross-site scripting or similar attacks in order to execute.

Recommendations: For versions prior to 5.7.2.1, update to version 5.7.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the unused delete routes to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-2653

RHSA-2017:0898

Affected Products

Cloudforms

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-2653 · Security Note
• https://access.redhat.com/errata/RHSA-2017:0898 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2653 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2653 · Note
• http://securityfocus.com/bid/96964 · Note