Privilege Escalation

2019-01-1509:14:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.001 Low

EPSS

Percentile

49.4%

JSON

cfme is vulnerable to privilege escalation attacks. The vulnerability exists as it was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.

CPENameOperatorVersion
cfme-applianceeq5.5.0.13__1.el7cf
cfme-applianceeq5.5.4.2__1.el7cf
cfme-applianceeq5.6.2.1__1.el7cf
cfme-applianceeq5.6.0.13__1.el7cf
cfme-applianceeq5.6.1.2__1.el7cf
cfme-applianceeq5.5.5.4__1.el7cf
cfme-applianceeq5.5.3.4__1.el7cf
cfme-applianceeq5.5.2.4__1.el7cf
cfmeeq5.5.4.2__1.el7cf
cfmeeq5.6.2.1__1.el7cf

Name	Operator	Version
cfme-appliance	eq	5.5.0.13__1.el7cf
cfme-appliance	eq	5.5.4.2__1.el7cf
cfme-appliance	eq	5.6.2.1__1.el7cf
cfme-appliance	eq	5.6.0.13__1.el7cf
cfme-appliance	eq	5.6.1.2__1.el7cf
cfme-appliance	eq	5.5.5.4__1.el7cf
cfme-appliance	eq	5.5.3.4__1.el7cf
cfme-appliance	eq	5.5.2.4__1.el7cf
cfme	eq	5.5.4.2__1.el7cf
cfme	eq	5.6.2.1__1.el7cf