CVE-2017-7530

CWE-862 — Missing Authorization5 documents5 sources
Severity
8.8HIGH
EPSS
0.3%
top 44.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Redhat Cloudforms Management EngineRED HAT CfmeRedhat Cloudforms
Timeline
PublishedJul 26
Latest updateMay 13

Description

In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5red_hat/cfme5.7.3, 5.8.1+1

🔴Vulnerability Details

2
GHSA
GHSA-hvp5-xq7g-8w42: In CloudForms Management Engine (cfme) before 5↗2022-05-13
▶
CVEList
CVE-2017-7530: In CloudForms Management Engine (cfme) before 5↗2018-07-26
▶

📋Vendor Advisories

1
Red Hat
cfme: Execution of arbitrary methods through filter param↗2017-08-02
▶

💬Community

1
Bugzilla
CVE-2017-7530 cfme: Execution of arbitrary methods through filter param↗2017-06-27
▶
CVE-2017-7530 (HIGH CVSS 8.8) | In CloudForms Management Engine (cf | cvebase.io