CVE-2014-0136: Input Validation
Published Oct 27, 2014
·Updated
The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
Affected Software
1 affected component
redhat Cloudforms 3.0 Management Engine<=5.2.5.3
Event History
Oct 27, 2014
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-0136?
CVE-2014-0136 has a medium severity rating due to its potential for log manipulation by remote attackers.
2
How do I fix CVE-2014-0136?
To fix CVE-2014-0136, update Red Hat CloudForms Management Engine to version 5.2.5.3 or later.
3
What are the potential impacts of CVE-2014-0136?
The potential impacts of CVE-2014-0136 include unauthorized access to log files and the possibility of log injection attacks.
4
Is CVE-2014-0136 applicable to my version of Red Hat CloudForms?
CVE-2014-0136 affects Red Hat CloudForms 3.0 Management Engine versions up to and including 5.2.5.3.
5
Can CVE-2014-0136 be exploited remotely?
Yes, CVE-2014-0136 can be exploited remotely by attackers to insert arbitrary text into log files.