CFME: VMRC plugin console grants users administrative access

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

CVE-2017-12191

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

CVE-2017-12191

The CVE-2017-12191 entry describes a CloudForms/Vmware issue where the CloudForms account configuration uses a shared, privileged account for VMRC functions. This flaws allows attackers to view and modify VMRC settings and the controlled virtual machines. Red Hat RHSA-2018:0374 documents a securi...

CVE-2017-12191: Improper Access Control

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

PT-2018-5381 · Red Hat · Cloudforms

Name of the Vulnerable Software and Affected Versions: CloudForms affected versions not specified Description: A flaw was found in the CloudForms account configuration when using VMware, where a shared account with privileged access to VMRC functions is used by default. This could allow an attack...

CVE-2017-12191

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC VMWare Remote Console functions that may not be appropriate for users of CloudForms and thus this account. An attacker could use this vulnerability t...

(RHSA-2018:0092) Important: Red Hat CloudForms 4.0 security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. CloudForms virtual machines include a copy of the Linux Kernel. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructio...

(RHSA-2018:0091) Important: Red Hat CloudForms 4.5 security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. CloudForms virtual machines include a copy of the Linux Kernel. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructio...

(RHSA-2018:0090) Important: Red Hat CloudForms 4.2 security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. CloudForms virtual machines include a copy of the Linux Kernel. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructio...

(RHSA-2018:0089) Important: Red Hat CloudForms 4.1 security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. CloudForms virtual machines include a copy of the Linux Kernel. Security Fixes: An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of instructio...

Red Hat CloudForms Management Engine ManageIQ Authentication Bypass Vulnerability

Red Hat CloudForms Management Engine CFME is a management engine for IaaS Infrastructure as a Service cloud service solutions from Red Hat, Inc. ManageIQ is a virtualization manager used in it. A security vulnerability exists in the checkprivileges method of the...

Authorization

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2014-0087

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2014-0087

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

CVE-2014-0087

Affected product: ManageIQ / Red Hat CloudForms Management Engine (CFME). Issue: The check_privileges method in vmdb/app/controllers/application_controller.rb allows remote authenticated users to bypass authorization by exploiting improper RBAC checking, specifically related to the rbac_user_edit...

CVE-2014-0087: Undefined Security Weakness

The checkprivileges method in vmdb/app/controllers/applicationcontroller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine CFME, allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbacuseredit action...

Red Hat CloudForms HTML Injection Vulnerability

Red Hat CloudForms is a suite of IaaS Infrastructure as a Service cloud service solutions from Red Hat, Inc. The solution creates and manages private and public clouds and has the ability to manage the application lifecycle. An HTML injection vulnerability exists in Red Hat CloudForms, which stem...

CVE-2017-15125

A flaw was found in CloudForms in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP Content Securi...

Important: Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

An update for cfme, cfme-appliance, and cfme-gemset is now available for CloudForms Management Engine 5.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CloudForms: lack of RBAC on various methods in web UI

CloudForms lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails applications portion of CloudForms to escalate privileges...