Lucene search

RedhatCVE-2017-15123

HistoryJun 12, 2019 - 2:29 p.m.

CVE-2017-15123

2019-06-1214:29:00

CWE-306

redhat

web.nvd.nist.gov

cve-2017-15123

cloudforms

web interface

rss feed

unauthorized access

security flaw

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

49.8%

JSON

A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.

Affected configurations

Nvd

Vulners

Node

redhatcloudforms_management_engineRange5.8–5.10

VendorProductVersionCPE
redhatcloudforms_management_engine*cpe:2.3:a:redhat:cloudforms_management_engine:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
redhat	cloudforms_management_engine	*	cpe:2.3:a:redhat:cloudforms_management_engine::::::::

CNA Affected

[
  {
    "product": "CloudForms",
    "vendor": "redhat",
    "versions": [
      {
        "status": "affected",
        "version": "5.8 - 5.10"
      }
    ]
  }
]

References

www.securityfocus.com/bid/108690

bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123

hacked0x90.wordpress.com/2019/07/17/cve-2017-15123-exploit/

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

5.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0.001

Percentile

49.8%

JSON

Related for CVE-2017-15123