CVE-2017-2632
published 2018-07-27CVE-2017-2632: A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level…
PriorityP425medium4.9CVSS 3.0
AVNACLPRHUINSUCNIHAN
EPSS
1.47%
70.7th percentile
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat | cfme | — | — |
| redhat | cloudforms | — | — |
| redhat | cloudforms_management_engine | < 5.7.1.3 | 5.7.1.3 |
CVSS provenance
nvdv3.04.9MEDIUMCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N
vendor_redhat4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cfme: tenant administrator can create a group with higher permissions
vendor_redhat·2017-02-27·CVSS 4.9
CVE-2017-2632 [MEDIUM] CWE-285 cfme: tenant administrator can create a group with higher permissions
cfme: tenant administrator can create a group with higher permissions
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
A logic error in valid_role() in CloudForms role validation could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
GHSA
GHSA-859c-mmxf-c34p: A logic error in valid_role() in CloudForms role validation before 5
ghsa_unreviewed·2022-05-13
CVE-2017-2632 [MEDIUM] CWE-863 GHSA-859c-mmxf-c34p: A logic error in valid_role() in CloudForms role validation before 5
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
No detection rules found.
No public exploits indexed.
2018-07-27
Published