CVE-2017-2664

CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges...

CVE-2017-2664

CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges...

Code injection

CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges...

CVE-2017-2664

CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges...

CVE-2017-2664

CloudForms Management Engine (cfme) is affected by CVE-2017-2664. The issue is a lack of RBAC controls on certain methods in the Rails application, enabling privilege escalation for an attacker with access. Affected versions are cfme before 5.7.3 and 5.8.x before 5.8.1. Red Hat advisories RHSA-20...

CVE-2017-7530

In CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should n...

CVE-2017-7530

In CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should n...

Privilege escalation

In CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should n...

CVE-2017-7530

In CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should n...

CVE-2017-7530

CVE-2017-7530 affects CloudForms Management Engine (cfme) prior to 5.7.3 and 5.8.x prior to 5.8.1, where privilege checks can be bypassed when API users trigger arbitrary methods via VMs filtered by MiqExpression. This could let an attacker perform disallowed actions (e.g., destroying VMs). The i...

Red Hat CloudForms Management Engine Logic Flaw Vulnerability

The Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud services solutions from Red Hat, Inc. A security vulnerability exists in dRuby in Red Hat CFME that stems from a failure to properly configure security settings. An attacker could explo...

CVE-2017-2664: Improper Access Control

CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges...

CVE-2017-7530: Missing Authorization

In CloudForms Management Engine cfme before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should n...

PT-2018-8398

Name of the Vulnerable Software and Affected Versions CloudForms Management Engine cfme versions prior to 5.7.3 CloudForms Management Engine cfme versions 5.8.x prior to 5.8.1 Description A missing privilege check was found in the CloudForms Management Engine when invoking arbitrary methods via...

PT-2018-7167

Name of the Vulnerable Software and Affected Versions: CloudForms Management Engine cfme versions prior to 5.7.3 CloudForms Management Engine cfme versions 5.8.x prior to 5.8.1 Description: The issue is related to a lack of Role-Based Access Control RBAC controls on certain methods within the rai...

CVE-2018-10905

CloudForms Management Engine cfme is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user...

CVE-2018-10905

CloudForms Management Engine cfme is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user...

Design/Logic Flaw

CloudForms Management Engine cfme is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user...

CVE-2018-10905

CloudForms Management Engine cfme is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user...

CVE-2018-10905

CVE-2018-10905 affects Red Hat CloudForms Management Engine (cfme) via an improper access control in the dRuby (DRb) component. A local attacker with access to an unprivileged shell can execute arbitrary commands as a highly privileged user (root). The issue is documented across Red Hat advisorie...