Critical severity · published Sep 25, 2017
CVE-2015-7544
redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to…
9.1
CVSS
3.4%
EPSS
No
On KEV
Description
redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.4% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
Enterprise Virtualization Manager · Redhat
3.4; 3.4.1; 3.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-7544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-7544
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1269588
Vendor Advisory
https://rhn.redhat.com/errata/RHSA-2016-0426.html
More from Enterprise Virtualization Manager
9.8
CVE-2018-1072
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files
7.8
CVE-2018-8897
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all…
5.9
CVE-2015-5293
Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None, which might allow remote attackers to…
3.1
CVE-2009-3552
In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation…
–
CVE-2015-0257
Red Hat Enterprise Virtualization (RHEV) Manager before 3.5.1 uses weak permissions on the directories shared by the ovirt-engine-dwhd service and a plugin during service startup,…