Unknown CFME vulnerabilities
3 vulnerabilities
Known vulnerabilities in Unknown CFME, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-10905redhatcloudforms+2
EPSS score0.47%
CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.CVE-2016-5402redhatcloudforms+13EPSS score5.93%
A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as.CVE-2017-7497redhatcloudforms_management_engine+1EPSS score0.99%
The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.