Unscored severity · published Oct 27, 2014
CVE-2014-0136
The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via…
–
CVSS
1.6%
EPSS
No
On KEV
Description
The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 75% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C3
Cloudforms 3.0 Management Engine · Redhat
through 5.2.5.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0136
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1037.html
www.securityfocus.com
http://www.securityfocus.com/bid/69233
More from Cloudforms 3.0 Management Engine
6.5
CVE-2014-7813
Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym…
–
CVE-2014-3642
vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via…
–
CVE-2014-0140
Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request
–
CVE-2014-3489
lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords…
–
CVE-2014-3486
The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before…