CVE-2017-2664: red hat cloudforms Improper Access Control
Vulnerability summary
CVE-2017-2664 is a medium (CVSS 6.5) Improper Access Control vulnerability in red hat cloudforms. EPSS estimates a 1.30% chance of exploitation in the next 30 days, higher than 70% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 26-07-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.
CVSS metrics
4 scores · 3 sources · 2 versions- NVDNIST6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
1.30%
Chance of exploitation in the next 30 days
Percentile
70%
Versus all other CVEs
30-day change
-0.02 pp
From 1.32% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat10 products
- cloudforms4.2 | 4.6
- cloudforms_management_engine< 5.7.3 | ≥ 5.8, < 5.8.1
- cfme< 0:5.7.4.2-1.el7cf
- cfme-appliance< 0:5.7.4.2-1.el7cf
- cfme-appliance-debuginfo< 0:5.7.4.2-1.el7cf
Red hat1 product
- cloudforms5.7.3 | 5.8.1
2 vendors · 11 products
References
121 linksShow all 100 references
Showing 100 of 121. Use Open JSON for the complete list.