CVE-2014-0140: Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request

Unscored severity · published Oct 6, 2014

CVE-2014-0140

Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request

–

CVSS

1.2%

EPSS

On KEV

Description

Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.

Exploitation

Is it being used?

Exploit prediction (EPSS)1.2% · higher than 69% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Cloudforms 3.0 Management Engine · Redhat

5.2 · source: NVD

Cloudforms 3.0.1 Management Engine · Redhat

5.2.1 · source: NVD

Cloudforms 3.0.2 Management Engine · Redhat

5.2.2 · source: NVD

Cloudforms 3.0.3 Management Engine · Redhat

5.2.3 · source: NVD

Cloudforms 3.0.4 Management Engine · Redhat

5.2.4 · source: NVD

Cloudforms 3.0.5 Management Engine · Redhat

through 5.2.5 · source: NVD

Affected product

Cloudforms 3.0 Management Engine

Redhat

All Cloudforms 3.0 Management Engine CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2014-0140

CVE.org

https://www.cve.org/CVERecord?id=CVE-2014-0140

Vendor Advisory

http://rhn.redhat.com/errata/RHSA-2014-1317.html

bugzilla.redhat.com

https://bugzilla.redhat.com/show_bug.cgi?id=1077359

More from Cloudforms 3.0 Management Engine

6.5

CVE-2014-7813

Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym…

–

CVE-2014-0136

The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via…

–

CVE-2014-3642

vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via…

–

CVE-2014-3489

lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords…

–

CVE-2014-3486

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before…