Lucene search

[email protected]CVE-2013-2050

HistoryJan 11, 2014 - 1:55 a.m.

CVE-2013-2050

2014-01-1101:55:00

CWE-89

[email protected]

web.nvd.nist.gov

cve-2013-2050

sql injection

red hat

cloudforms

nvd

security vulnerability

manageiq

8.2 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.014 Low

EPSS

Percentile

86.3%

JSON

SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.

CPENameOperatorVersion
redhat:cloudforms_management_engineredhat cloudforms management engineeq5.1
redhat:manageiq_enterprise_virtualization_managerredhat manageiq enterprise virtualization managerle5.0

CPE	Name	Operator	Version
redhat:cloudforms_management_engine	redhat cloudforms management engine	eq	5.1
redhat:manageiq_enterprise_virtualization_manager	redhat manageiq enterprise virtualization manager	le	5.0

References

packetstormsecurity.com/files/124609/cfme_manageiq_evm_pass_reset.rb.txt

secunia.com/advisories/56181

www.securityfocus.com/bid/64524

bugzilla.redhat.com/show_bug.cgi?id=959062

exchange.xforce.ibmcloud.com/vulnerabilities/89984

8.2 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.014 Low

EPSS

Percentile

86.3%

JSON

Related for CVE-2013-2050

checkpoint_advisories1 cvelist1 prion1 packetstorm1