PT-2019-8017 · Red Hat · Cloudforms

Hacked0X90 · Published 2019-06-12 · Updated 2019-07-17 · CVE-2017-15123

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions CloudForms versions 5.8 through 5.10

Description A flaw was found in the CloudForms web interface where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms, including data such as newly created virtual machines.

Recommendations For CloudForms versions 5.8 through 5.10, restrict access to the RSS feed URLs to authenticated users only to prevent unauthorized viewing of sensitive information. As a temporary workaround, consider disabling the RSS feed feature until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2017-15123

Affected Products

Cloudforms

References · 6

• https://osv.dev/vulnerability/CVE-2017-15123 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-15123 · Security Note
• https://t.me/cibsecurity/4870 · Telegram Post
• https://hacked0x90.wordpress.com/2019/07/17/cve-2017-15123-exploit · Note
• http://securityfocus.com/bid/108690 · Note