Redhat Cloudforms vulnerabilities

CVE-2018-1101 [HIGH] CWE-266 CVE-2018-1101: Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administr Ansible Tower before version 3.2.4 has a flaw in the management of system and organization administrators that allows for privilege escalation. System administrators that are members of organizations can have their passwords reset by organization administrators, allowing organization administrators access to the entire system.

CVE-2017-12191 [HIGH] CWE-284 CVE-2017-12191: A flaw was found in the CloudForms account configuration when using VMware. By default, a shared acc A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and

CVE-2018-10905 [HIGH] CWE-284 CVE-2018-10905: CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby compo CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.

CVE-2020-10779 [MEDIUM] CWE-639 CVE-2020-10779: Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms.

CVE-2014-0197 [HIGH] CWE-352 CVE-2014-0197: CFME: CSRF protection vulnerability via permissive check of the referrer header CFME: CSRF protection vulnerability via permissive check of the referrer header

CVE-2017-2639 [HIGH] CWE-295 CVE-2017-2639: It was found that CloudForms does not verify that the server hostname matches the domain name in the It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and communicating with Red Hat Virtualization (RHEV) and OpenShift. This would allow an attacker to spoof RHEV or OpenShift systems and potentially harvest sensitive information from CloudForms.

CVE-2017-2664 [MEDIUM] CWE-284 CVE-2017-2664: CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certa CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.

CVE-2017-2653 [MEDIUM] CWE-20 CVE-2017-2653: A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.

CVE-2018-10855 [MEDIUM] CWE-532 CVE-2018-10855: Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tas Ansible 2.5 prior to 2.5.5, and 2.4 prior to 2.4.5, do not honor the no_log task flag for failed tasks. When the no_log flag has been used to protect sensitive data passed to a task from being logged, and that task does not run successfully, Ansible will expose sensitive data in log files and on the terminal of the user running Ansible.

CVE-2018-1053 [HIGH] CWE-377 CVE-2018-1053: In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory containing the output of `pg_dumpall -g` under umask which was in effect when the user invoked pg_upgrade, and not under 0077 which is normally used for other temporary files. This can

CVE-2012-5604 [MEDIUM] CWE-264 CVE-2012-5604: The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for auth The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors.

CVE-2020-14369 [MEDIUM] CWE-352 CVE-2020-14369: This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing r

CVE-2020-10778 [MEDIUM] CWE-669 CVE-2020-10778: In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dro In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.

CVE-2017-15123 [MEDIUM] CWE-306 CVE-2017-15123: A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are n A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.

CVE-2013-6443 [MEDIUM] CWE-352 CVE-2013-6443: CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.

CVE-2020-10777 [MEDIUM] CWE-79 CVE-2020-10777: A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An att A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms.

CVE-2018-11627 [MEDIUM] CWE-79 CVE-2018-11627: Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

CVE-2012-5603 [MEDIUM] CWE-264 CVE-2012-5603: proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permission proxies_controller.rb in Katello in Red Hat CloudForms before 1.1 does not properly check permissions, which allows remote authenticated users to read consumer certificates or change arbitrary users' settings via unspecified vectors related to the "consumer UUID" of a system.

CVE-2017-2632 [MEDIUM] CWE-285 CVE-2017-2632: A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant admi A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.

CVE-2013-0186 [MEDIUM] CWE-79 CVE-2013-0186: Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to injec Multiple cross-site scripting (XSS) vulnerabilities in ManageIQ EVM allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.