4.1med
CVE-2017-2653
A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST reque…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
4.1
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.4%
percentile 72%
Public exploits
0
none known
Summary
A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.
Exploit prediction (EPSS)
1.39% probability of exploitation in the next 30 days, higher than 72% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 4.1 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N |
| CNA | 3.0 | 4.1 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N |
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Affected products
- Red Hat CloudForms
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- access.redhat.com /errata/RHSA-2017:0898 · vendor-advisory, x_refsource_REDHAT, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2653 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/96964 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-2653
- NVD: CVE-2017-2653
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.