CVE-2014-0078
published 2014-05-14CVE-2014-0078: The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors…
PriorityP419medium4CVSS 2.0
AVNACLAuSCNINAP
EPSS
1.02%
59.4th percentile
The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | cloudforms_3.0_management_engine | <= 5.2.3 | — |
| redhat | cloudforms_3.0_management_engine | — | — |
| redhat | cloudforms_3.0_management_engine | — | — |
| redhat | cloudforms_3.0_management_engine | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fxwq-pp2x-ch5j: The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5
ghsa_unreviewed·2022-05-17
CVE-2014-0078 [MEDIUM] GHSA-fxwq-pp2x-ch5j: The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5
The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.
Red Hat
CFME: multiple authorization bypass vulnerabilities in CatalogController
vendor_redhat·2014-05-12·CVSS 4.0
CVE-2014-0078 [MEDIUM] CWE-862 CFME: multiple authorization bypass vulnerabilities in CatalogController
CFME: multiple authorization bypass vulnerabilities in CatalogController
The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0087 CFME: check_privileges logic error resulting in privilege escalation
bugzilla·2014-02-20·CVSS 4.0
CVE-2014-0087 [MEDIUM] CVE-2014-0087 CFME: check_privileges logic error resulting in privilege escalation
CVE-2014-0087 CFME: check_privileges logic error resulting in privilege escalation
Jan Rusnacko of the Red Hat Product Security Team reports:
CFME contains an authorization bypass issue in the action rbac_user_edit,
which allows authenticated users with minimal privileges to gain access to
additional privileges.
The problem is in the method check_privileges in vmdb/app/controllers/application_controller.rb:
def check_generic_rbac
ident = "#{controller_name}_#{action_name}"
if MiqProductFeature.feature_exists?(ident)
passed = role_allows(:feature => ident, :any => true)
unless passed
if request.xml_http_request?
render :update do |page|
page.redirect_to :controller => 'dashboard', :action => 'auth_error'
end
else
redirect_to(:controller => 'dashboard', :action => 'auth_error')
end
end
Bugzilla
CVE-2014-0078 CFME: multiple authorization bypass vulnerabilities in CatalogController
bugzilla·2014-02-12·CVSS 4.0
CVE-2014-0078 [MEDIUM] CVE-2014-0078 CFME: multiple authorization bypass vulnerabilities in CatalogController
CVE-2014-0078 CFME: multiple authorization bypass vulnerabilities in CatalogController
Jan Rusnacko of the Red Hat Product Security Team reports:
CFME fails to check if the current user is allowed to delete catalogs. Regular
user with minimal privileges will not see Catalog menu, as role based check is
performed in view (layouts/_page_header_navbar.html.haml):
45 -if role_allows(:feature => 'catalog',:any => true)
46 %li(class="#{secondary_nav_class('catalogs')}")
47 %a{:href=>'/catalog/explorer'}Catalogs
In the context of running application:
(rdb:1) User.current_user.name
"testuser1"
(rdb:1) role_allows(:feature => 'catalog',:any => true)
false
By POSTing a request and going through catalog IDs sequentially an attacker
can delete all catalogs.
Discussion:
Acknowledgements:
This
2014-05-14
Published