CVE-2017-2632: red hat cfme Improper Authorization
Vulnerability summary
CVE-2017-2632 is a medium (CVSS 4.9) Improper Authorization vulnerability in red hat cfme. EPSS estimates a 1.45% chance of exploitation in the next 30 days, higher than 73.5% of scored vulnerabilities.
Not severe (CVSS 4.9, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 27-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST4.9MediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.45%
Chance of exploitation in the next 30 days
Percentile
74%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.45% on 05-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Affected systems
Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat2 products
- cloudforms4.2
- cloudforms_management_engine< 5.7.1.3
Red hat1 product
- cfme5.7.1.3
2 vendors · 3 products
References
3 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2632X Refsource CONFIRMIssue TrackingThird Party Advisory