CVE-2014-0137

2014-05-1419:55:10

CWE-89

[email protected]

web.nvd.nist.gov

cve-2014-0137

sql injection

red hat cloudforms management engine

cfme

remote authenticated users

nvd

miqreportresult.exists

CVSS2

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

AI Score

8.2

Confidence

Low

EPSS

0.001

Percentile

46.5%

JSON

SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.

Affected configurations

NVD

Node

redhatcloudforms_3.0_management_engineRange≤5.2.3

redhatcloudforms_3.0_management_engineMatch5.2

redhatcloudforms_3.0_management_engineMatch5.2.1

redhatcloudforms_3.0_management_engineMatch5.2.2

VendorProductVersionCPE
redhatcloudforms_3.0_management_engine5.2cpe:/a:redhat:cloudforms_3.0_management_engine:5.2:::
redhatcloudforms_3.0_management_engine5.2.2cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.2:::
redhatcloudforms_3.0_management_enginecpe:/a:redhat:cloudforms_3.0_management_engine::::
redhatcloudforms_3.0_management_engine5.2.1cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.1:::

Vendor	Product	Version	CPE
redhat	cloudforms_3.0_management_engine	5.2	cpe:/a:redhat:cloudforms_3.0_management_engine:5.2:::
redhat	cloudforms_3.0_management_engine	5.2.2	cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.2:::
redhat	cloudforms_3.0_management_engine		cpe:/a:redhat:cloudforms_3.0_management_engine::::
redhat	cloudforms_3.0_management_engine	5.2.1	cpe:/a:redhat:cloudforms_3.0_management_engine:5.2.1:::