Red Hat Cloudforms 3.0 Management Engine vulnerabilities

13 CVEs affecting Red Hat Cloudforms 3.0 Management Engine, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2014-7813, published 2017-10-18.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-0180, published 2014-07-07. Medium severity, CVSS 5.0. EPSS: 1.8% chance of exploitation in the next 30 days. The wait_for_task function in app/controllers/application_controller.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to cause a denial of service…
CVE-2014-0057, published 2014-03-18. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via…
CVE-2014-3489, published 2014-07-07. Medium severity, CVSS 4.3. EPSS: 1.6% chance of exploitation in the next 30 days. lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force…
CVE-2014-0136, published 2014-10-27. Medium severity, CVSS 5.0. EPSS: 1.6% chance of exploitation in the next 30 days. The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
CVE-2014-0137, published 2014-05-14. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute…
CVE-2014-0176, published 2014-07-07. Medium severity, CVSS 4.3. EPSS: 1.4% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in application/panel_control in CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allows remote attackers to inject arbitrary web script or HTML via…
CVE-2014-3642, published 2014-10-06. Medium severity, CVSS 6.5. EPSS: 1.3% chance of exploitation in the next 30 days. vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors,…
CVE-2014-0140, published 2014-10-06. Medium severity, CVSS 4.0. EPSS: 1.2% chance of exploitation in the next 30 days. Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.
CVE-2014-7813, published 2017-10-18. Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days. Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym rails function and lack…
CVE-2014-0078, published 2014-05-14. Medium severity, CVSS 4.0. EPSS: 1% chance of exploitation in the next 30 days. The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

Latest

CVE-2014-3486, published 2014-07-07. Medium severity, CVSS 6.9. EPSS: 0.4% chance of exploitation in the next 30 days. The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users…
CVE-2014-0184, published 2014-07-07. Medium severity, CVSS 4.9. EPSS: 0.4% chance of exploitation in the next 30 days. Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.