CVE-2014-3486

CWE-59CWE-3775 documents5 sources
Severity
6.9MEDIUM
EPSS
0.2%
top 60.88%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Cloudforms 3.0 Management Engine
Timeline
PublishedJul 7
Latest updateMay 17

Description

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

CVSS vector

AV:L/AC:M/C:C/I:C/A:CExploitability: 3.4 | Impact: 10.0

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-4r83-3x2w-gg64: The (1) shell_exec function in lib/util/MiqSshUtilV1↗2022-05-17
▶
CVEList
CVE-2014-3486: The (1) shell_exec function in lib/util/MiqSshUtilV1↗2014-07-07
▶

📋Vendor Advisories

1
Red Hat
CFME: SSH Utility insecure tmp file creation leading to code execution as root↗2014-06-30
▶

💬Community

1
Bugzilla
CVE-2014-3486 CFME: SSH Utility insecure tmp file creation leading to code execution as root↗2014-06-10
▶