8.8
High
CVE-2017-7530 In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing…
Description
In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).
Affected products and versions
Other CVEs of CFME
The 5 CVEs of CFME →
CVE-2019-10159
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper…
4.3
Medium
CVE-2016-7047
A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2
4.3
Medium
CVE-2016-7071
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs…
8.8
High
CVE-2017-2632
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to…
4.9
Medium