6.5med
CVE-2017-2664
CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application por…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
6.5
v3.0 · CNA
CISA KEV
No
not known exploited
EPSS
1.3%
percentile 71%
Public exploits
0
none known
Summary
CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.
Exploit prediction (EPSS)
1.30% probability of exploitation in the next 30 days, higher than 71% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 3.0 | 6.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N |
Affected products
- Red Hat CloudForms
Classification
- Weakness
- CWE-284 Improper Access Control
References
- access.redhat.com /errata/RHSA-2017:3484 · vendor-advisory, x_refsource_REDHAT, x_transferred
- securityfocus.com /bid/100148 · vdb-entry, x_refsource_BID, x_transferred
- access.redhat.com /errata/RHSA-2017:1758 · vendor-advisory, x_refsource_REDHAT, x_transferred
- bugzilla.redhat.com /show_bug.cgi?id=CVE-2017-2664 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-2664
- NVD: CVE-2017-2664
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.