CVE-2018-10905CWE-284

CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms

High · published July 24, 2018

CVSS v3.0
7.8
EPSS
0%
Percentile
39.7
In the wild
Unconfirmed
What it is

CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00474 · 39.7th percentile
Weakness
CWE-284 · Improper Access Control
Published
2018-07-24T13:00Z
EPSS history
Timeline
  • 24 JUL 13:00Z
    CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms
    cvelistv5