CVE-2017-2653: red hat cloudforms Improper Input Validation
Vulnerability summary
CVE-2017-2653 is a medium (CVSS 6.5) Improper Input Validation vulnerability in red hat cloudforms. EPSS estimates a 1.39% chance of exploitation in the next 30 days, higher than 71.7% of scored vulnerabilities.
Timeline
- 27-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.
CVSS metrics
4 scores · 3 sources · 2 versions- CVE.orgCNA4.1MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:NDiffers
- OSV · Red hatEcosystem advisory · calculated4.1MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:NDiffers
EPSS trend
Probability
1.39%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
0.00 pp
From 1.39% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat7 products
- cloudforms4.2
- cloudforms_management_engine< 5.7.2.1
- cfme< 0:5.7.2.1-1.el7cf
- cfme-appliance< 0:5.7.2.1-1.el7cf
- cfme-appliance-debuginfo< 0:5.7.2.1-1.el7cf
Red hat1 product
- cloudforms5.7.2.1
2 vendors · 8 products
References
146 links- access.redhat.com/errata/RHSA-2017:0898Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2653X Refsource CONFIRMIssue TrackingThird Party Advisory
Show all 100 references
Showing 100 of 146. Use Open JSON for the complete list.