Red Hat CloudForms Management Engine 5.8

CPE Details

Red Hat CloudForms Management Engine 5.8
5.8
2018-10-30
13h18 +00:00
2018-10-30
13h18 +00:00
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
Notifications manage

CPE Name: cpe:2.3:a:redhat:cloudforms_management_engine:5.8:*:*:*:*:*:*:*

Informations

Vendor

redhat

Product

cloudforms_management_engine

Version

5.8

Related CVE

Open and find in CVE List

CVE ID Published Description Score Severity
CVE-2020-14324 2020-08-11 11h19 +00:00 A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.
9.1
Critical
CVE-2014-0197 2019-12-13 11h48 +00:00 CFME: CSRF protection vulnerability via permissive check of the referrer header
8.8
High
CVE-2018-10854 2019-11-22 10h51 +00:00 cloudforms version, cloudforms 5.8 and cloudforms 5.9, is vulnerable to a cross-site-scripting. A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting due to improper sanitization of user input in Name field.
5.4
Medium
CVE-2017-15123 2019-06-12 11h39 +00:00 A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.
5.3
Medium
CVE-2016-7047 2018-09-11 11h00 +00:00 A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access.
4.3
Medium
CVE-2017-15125 2018-07-27 13h00 +00:00 A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTML and JavaScript input. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms. Please note that CSP (Content Security Policy) prevents exploitation of this XSS however not all browsers support CSP.
6.5
Medium
CVE-2017-2639 2018-07-27 11h00 +00:00 It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.
7.5
High
CVE-2017-2664 2018-07-26 12h00 +00:00 CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.
6.5
Medium
CVE-2018-10905 2018-07-24 11h00 +00:00 CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.
7.8
High