CVE-2019-14894
published 2020-06-22CVE-2019-14894: A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS…
PriorityP351high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
4.08%
89.5th percentile
A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | cloudforms_management_engine | — | — |
| redhat | cloudforms_management_engine | — | — |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
vendor_redhat8.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
CloudForms: RCE vulnerability in NFS schedule backup
vendor_redhat·2020-02-24·CVSS 8.0
CVE-2019-14894 [HIGH] CWE-78 CloudForms: RCE vulnerability in NFS schedule backup
CloudForms: RCE vulnerability in NFS schedule backup
A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.
A flaw was found in the CloudForms management engine, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.
GHSA
GHSA-ghxf-76c7-3c47: A flaw was found in the CloudForms management engine version 5
ghsa_unreviewed·2022-05-24
CVE-2019-14894 [HIGH] CWE-20 GHSA-ghxf-76c7-3c47: A flaw was found in the CloudForms management engine version 5
A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.
No detection rules found.
No public exploits indexed.
2020-06-22
Published