Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2017-7530

In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).

Published

2018-07-26T13:29:00.247

Last Modified

2024-11-21T03:32:05.543

Status

Modified

Source

[email protected]

Severity

CVSSv3.0: 8.8 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Access Vector: NETWORK
Access Complexity: LOW
Authentication: SINGLE
Confidentiality Impact: PARTIAL
Integrity Impact: PARTIAL
Availability Impact: PARTIAL

Exploitability Score

8.0

Impact Score

6.4

Weaknesses

Type: Secondary
CWE-862
Type: Primary
NVD-CWE-noinfo

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	redhat	cloudforms	4.5	Yes
Application	redhat	cloudforms_management_engine	< 5.7.3	Yes
Application	redhat	cloudforms_management_engine	< 5.8.1	Yes

References

http://www.securityfocus.com/bid/100151 Third Party Advisory, VDB Entry ([email protected])
https://access.redhat.com/errata/RHSA-2017:1758 Vendor Advisory ([email protected])
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7530 Issue Tracking, Vendor Advisory ([email protected])
http://www.securityfocus.com/bid/100151 Third Party Advisory, VDB Entry (af854a3a-2127-422b-91ae-364da2661108)
https://access.redhat.com/errata/RHSA-2017:1758 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7530 Issue Tracking, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)