Unscored severity · published Jul 7, 2014
CVE-2014-3486
The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before…
–
CVSS
0.4%
EPSS
No
On KEV
Description
The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C3
Cloudforms 3.0 Management Engine · Redhat
through 5.2.4; 5.2; 5.2.1; 5.2.1.6; 5.2.2; 5.2.3; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3486
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3486
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-0816.html
www.securityfocus.com
http://www.securityfocus.com/bid/68300
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1107528
More from Cloudforms 3.0 Management Engine
6.5
CVE-2014-7813
Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym…
–
CVE-2014-0136
The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via…
–
CVE-2014-3642
vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via…
–
CVE-2014-0140
Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request
–
CVE-2014-3489
lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords…