Privilege Escalation

2020-05-1501:24:32

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

53.5%

JSON

ruby is vulnerable to privilege escalation. The check_privileges method in vmdb/app/controllers/application_controller.rb allows authenticated users to bypass authorization and gain higher privileges due to improper RBAC checking.

CPENameOperatorVersion
ruby193-rubygem-linux_admineq0.7.0__1.el6cf
ruby193-rubygem-linux_admineq0.9.1__1.el6cf
ruby193-rubygem-linux_admineq0.5.6__1.el6cf
ruby193-rubygem-fogeq1.19.0__1.el6cf
ruby193-rubygem-fogeq1.10.1__10.el6ost
ruby193-rubygem-fogeq1.15.0__4.el6sat
ruby193-rubygem-fogeq1.10.1__11.el6ost
ruby193-rubygem-fogeq1.14.0__2.el6cf
cfmeeq5.2.3.2__1.el6cf
cfmeeq5.3.0.15__1.el6cf

Name	Operator	Version
ruby193-rubygem-linux_admin	eq	0.7.0__1.el6cf
ruby193-rubygem-linux_admin	eq	0.9.1__1.el6cf
ruby193-rubygem-linux_admin	eq	0.5.6__1.el6cf
ruby193-rubygem-fog	eq	1.19.0__1.el6cf
ruby193-rubygem-fog	eq	1.10.1__10.el6ost
ruby193-rubygem-fog	eq	1.15.0__4.el6sat
ruby193-rubygem-fog	eq	1.10.1__11.el6ost
ruby193-rubygem-fog	eq	1.14.0__2.el6cf
cfme	eq	5.2.3.2__1.el6cf
cfme	eq	5.3.0.15__1.el6cf