CVE-2017-7530
published 2018-07-26CVE-2017-7530: In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via…
PriorityP353high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
EPSS
1.70%
74.6th percentile
In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| red_hat | cfme | — | — |
| red_hat | cfme | — | — |
| redhat | cloudforms | — | — |
| redhat | cloudforms_management_engine | < 5.7.3 | 5.7.3 |
| redhat | cloudforms_management_engine | >= 5.8.0 < 5.8.1 | 5.8.1 |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
cfme: Execution of arbitrary methods through filter param
vendor_redhat·2017-08-02·CVSS 8.8
CVE-2017-7530 [HIGH] CWE-862 cfme: Execution of arbitrary methods through filter param
cfme: Execution of arbitrary methods through filter param
In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).
It was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).
GHSA
GHSA-hvp5-xq7g-8w42: In CloudForms Management Engine (cfme) before 5
ghsa_unreviewed·2022-05-13
CVE-2017-7530 [HIGH] GHSA-hvp5-xq7g-8w42: In CloudForms Management Engine (cfme) before 5
In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).
No detection rules found.
No public exploits indexed.
2018-07-26
Published