CVE-2014-3521: Medium severity red hat conga vulnerability
The component in (1) /luci/homebase and (2) /luci/cluster menu in Red Hat Conga 0.12.2 allows remote authenticated users to bypass intended access restrictions via a crafted URL.
Other sources
Various components in the /luci/homebase and /luci/cluster menu, which should be restricted to administrative users only, are exposed to any logged-in (non-administrative, but authenticated) user if visited with a specially constructed URL. This could allow an authenticated, non-administrative, user to, among others: add new users, add systems, remove clusters from conga, and view logs.
This particular issue affects luci, as included in conga, and does not affect luci otherwise.
Acknowledgements:
This issue was discovered by Radek Steiger of Red Hat.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3521?
CVE-2014-3521 is classified as a moderate vulnerability due to its potential for authenticated users to bypass access controls.
How do I fix CVE-2014-3521?
To mitigate CVE-2014-3521, it is recommended to upgrade Red Hat Conga to a patched version that addresses the access restriction vulnerabilities.
Who is affected by CVE-2014-3521?
CVE-2014-3521 affects users of Red Hat Conga version 0.12.2 who have remote authenticated access.
What can attackers achieve with CVE-2014-3521?
Attackers exploiting CVE-2014-3521 can access administrative functionalities that should be restricted to privileged users.
Is there a workaround for CVE-2014-3521?
Currently, there are no documented workarounds for CVE-2014-3521 other than applying the recommended security patch.