PT-2018-8398
CVE-2017-7530
·
تاريخ النشر
2018-07-26
·
تاريخ التحديث
2019-10-09
الوصف من
CVSS 3.1
8.8
عاليةالمقاييسAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
CloudForms Management Engine (cfme) versions prior to 5.7.3
CloudForms Management Engine (cfme) versions 5.8.x prior to 5.8.1
Description
A missing privilege check was found in the CloudForms Management Engine when invoking arbitrary methods via filtering on VMs. This allows an attacker to execute actions they should not be allowed to, such as destroying VMs, by exploiting the MiqExpression execution triggered by API users.
Recommendations
For CloudForms Management Engine (cfme) versions prior to 5.7.3, update to version 5.7.3 or later.
For CloudForms Management Engine (cfme) versions 5.8.x prior to 5.8.1, update to version 5.8.1 or later.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾