CVE-2016-7071CWE-285
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users
High · published September 10, 2018
What it is
It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM.
The record
Technical detail
- CVSS v3.0
- 8.8 · HIGH
- Vector
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.02197 · 82.2th percentile
- Weakness
- CWE-285 · Improper Authorization
- Published
- 2018-09-10T15:00Z
EPSS history
Timeline