CVE-2017-2664CWE-284

CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms

Medium · published July 26, 2018

CVSS v3.0
6.5
EPSS
1%
Percentile
70.3
In the wild
Unconfirmed
What it is

CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01302 · 70.3th percentile
Weakness
CWE-284 · Improper Access Control
Published
2018-07-26T14:00Z
EPSS history
Timeline
  • 26 JUL 14:00Z
    CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms
    cvelistv5