Read the docs
TI-2017-05142 Aliases CVE-2017-7497GHSA-97vg-m3qf-f423

Improper access control in [UNKNOWN] CFME

Priority LOW 22CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.

Summary

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.

Why it matters now

EPSS 0.00991 62nd percentileScored 2026-11-07
Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]CFMEall versions—No fix listedCNA
  • CFME Vendor[UNKNOWN] Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:redhat:cloudforms_management_engine:5.7.2:*:*:*:*:*:*:*5.7.2VulnerableRed Hat
cpe:2.3:a:redhat:cloudforms_management_engine:5.8.0:*:*:*:*:*:*:*5.8.0VulnerableRed Hat
  • cpe:2.3:a:redhat:cloudforms_management_engine:5.7.2:*:*:*:*:*:*:* Versions 5.7.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:cloudforms_management_engine:5.8.0:*:*:*:*:*:*:* Versions 5.8.0 Vulnerable ·Red Hat

Remediation

Red Hat 2 advisories

  • RHSA-2017:1758 Released 2017-08-02 · Red Hat rating Important
    Red Hat CloudForms security, bug fix, and enhancement update
    • CloudForms Management Engine 5.8 ansible-2.3.0.0-1.el7, ansible-tower-server-3.1.3-1.el7at, ansible-tower-setup-3.1.3-1.el7at +5
  • RHSA-2017:1601 Released 2017-06-28 · Red Hat rating Important
    CFME 5.7.3 security, bug fix and enhancement update
    • CloudForms Management Engine 5.7 cfme-5.7.3.2-1.el7cf, cfme-appliance-5.7.3.2-1.el7cf, cfme-gemset-5.7.3.2-1.el7cf +4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat CFME — RHSA-2017:1758

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2017-05171 Missing authorization in Red Hat cfmePriority MEDIUM 41
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
CloudForms Management Engine 5.7Fixed RHSA-2017:1601
CloudForms Management Engine 5.8Fixed RHSA-2017:1758

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-7497
  2. 2026-10-03 Alias added: GHSA-97vg-m3qf-f423

References

Patch 1

Advisory 2

  • TI-2013-01839 Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms… CVSS 2.0HIGH 9.4
  • TI-2013-01821 SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0… CVSS 2.0HIGH 7.5
  • TI-2016-04680 Code injection in [UNKNOWN] cfme CVSS 3.0HIGH 8.8
  • TI-2020-11195 OS command injection in CloudForms CVSS 3.1CRITICAL 9.1
  • TI-2019-11098 Improper input validation in [UNKNOWN] CloudForms CVSS 3.1HIGH 8.0
  • TI-2016-06078 Improper authorization in Red Hat CFME CVSS 3.0HIGH 8.8
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences