Red Hat Security Advisory

RHSA-2015:0028

cfme security, bug fix, and enhancement update

Released 2015-01-14 · Red Hat rating Important · View on Red Hat →

Fixed in

CloudForms Management Engine 5.3 cfme-5.3.2.6-1.el6cf, cfme-appliance-5.3.2.6-1.el6cf, cfme-lib-5.3.2.6-1.el6cf +3

Fixes 3 records

TI-2014-03008 CVE-2014-3692 · GHSA-c5gm-gj7m-3h35

The customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a…

MEDIUM 48

The customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a default password for the root account when a password is not specified for a new image, which allows remote attackers to gain privi…

CVSS 2.0HIGH 10.0 Network No auth Interaction — EPSS 0.02946 Published 2015-01-16 Fixed CWE-255

TI-2014-00082 CVE-2014-0087 · GHSA-662v-625c-j7qp

The check_privileges method in vmdb/app/controllers/application_controller.rb in…

MEDIUM 42

The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privil…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.01812 Published 2018-01-11 Fixed CWE-264

TI-2014-06488 CVE-2014-7814 · GHSA-ww52-g4g7-mhj7

SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows…

LOW 32

SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.01414 Published 2015-01-16 Fixed CWE-89