4.9
Medium
CVE-2017-2632 A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to…
Description
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| CFME | 5.7.1.3 | No fix stated |
Other CVEs of CFME
The 5 CVEs of CFME →
CVE-2019-10159
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper…
4.3
Medium
CVE-2016-7047
A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2
4.3
Medium
CVE-2016-7071
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs…
8.8
High
CVE-2017-7530
In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing…
8.8
High