CVE-2017-12191: red hat, inc. cloudforms Improper Access Control
Vulnerability summary
CVE-2017-12191 is a high (CVSS 7.5) Improper Access Control vulnerability in red hat, inc. cloudforms. EPSS estimates a 0.88% chance of exploitation in the next 30 days, higher than 58.3% of scored vulnerabilities.
Timeline
- 28-02-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.
CVSS metrics
3 scores · 2 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated7.4HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
EPSS trend
Probability
0.88%
Chance of exploitation in the next 30 days
Percentile
58%
Versus all other CVEs
30-day change
0.00 pp
From 0.88% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-284Improper Access ControlThe product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
- CWE-613Insufficient Session ExpirationAccording to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
Affected systems
Redhat27 products
- cloudforms4.5
- ansible< 0:2.4.3.0-1.el7ae
- ansible-tower-server< 0:3.1.5-3.el7at
- ansible-tower-setup< 0:3.1.5-3.el7at
- cfme< 0:5.8.3.4-1.el7cf
Red hat, inc.1 product
- cloudforms≤ 5.9
2 vendors · 28 products
References
195 linksShow all 100 references
Showing 100 of 195. Use Open JSON for the complete list.