Unscored severity · published Oct 6, 2014
CVE-2014-3642
vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via…
–
CVSS
1.3%
EPSS
No
On KEV
Description
vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
C3
Cloudforms 3.0 Management Engine · Redhat
5.2 · source: NVD
C3
Cloudforms 3.0.1 Management Engine · Redhat
5.2.1 · source: NVD
C3
Cloudforms 3.0.2 Management Engine · Redhat
5.2.2 · source: NVD
C3
Cloudforms 3.0.3 Management Engine · Redhat
5.2.3 · source: NVD
C3
Cloudforms 3.0.4 Management Engine · Redhat
5.2.4 · source: NVD
C3
Cloudforms 3.0.5 Management Engine · Redhat
through 5.2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3642
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3642
Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2014-1317.html
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=1092894
More from Cloudforms 3.0 Management Engine
6.5
CVE-2014-7813
Red Hat CloudForms 3 Management Engine (CFME) allows remote authenticated users to cause a denial of service (resource consumption) via vectors involving calls to the .to_sym…
–
CVE-2014-0136
The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via…
–
CVE-2014-0140
Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request
–
CVE-2014-3489
lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords…
–
CVE-2014-3486
The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before…