Read the docs
TI-2013-01839 Aliases CVE-2013-2068GHSA-ggp4-2h22-73vm

Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms…

Priority HIGH 74CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Complete · Complete
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.

Summary

Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.

Why it matters now

EPSS 0.58624 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:redhat:cloudforms_management_engine:5.1:*:*:*:*:*:*:*5.1VulnerableRed Hat
  • cpe:2.3:a:redhat:cloudforms_management_engine:5.1:*:*:*:*:*:*:* Versions 5.1 Vulnerable ·Red Hat

Remediation

Red Hat 1 advisory

  • RHSA-2013:1206 Released 2013-09-04 · Red Hat rating Critical
    Red Hat CloudForms Management Engine security update
    • Red Hat CloudForms 2.0

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat CloudForms 2.0Fixed RHSA-2013:1206
Not affected: 1 product
  • CloudForms Management Engine 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-2068
  2. 2026-10-03 Alias added: GHSA-ggp4-2h22-73vm

References

Exploit 1

Advisory 1

Other 1

  • TI-2013-01821 SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0… CVSS 2.0HIGH 7.5
  • TI-2016-04680 Code injection in [UNKNOWN] cfme CVSS 3.0HIGH 8.8
  • TI-2020-11195 OS command injection in CloudForms CVSS 3.1CRITICAL 9.1
  • TI-2019-11098 Improper input validation in [UNKNOWN] CloudForms CVSS 3.1HIGH 8.0
  • TI-2016-06078 Improper authorization in Red Hat CFME CVSS 3.0HIGH 8.8
  • TI-2016-06051 Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions… CVSS 3.0HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences