CVE-2017-7530

8.8HIGH

Key Information:

Vendor
Red Hat
Status
Cfme
Vendor
CVE Published:
26 July 2018

Summary

In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).

Affected Version(s)

cfme 5.7.3

cfme 5.8.1

References

http://www.securityfocus.com/bid/100151
vdb-entryx_refsource_BID
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7530
x_refsource_CONFIRM
https://access.redhat.com/errata/RHSA-2017:1758
vendor-advisoryx_refsource_REDHAT

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.