CVE-2014-3642: Medium severity red hat cloudforms management engine 3.0.2 vulnerability
Jan Rusnacko of Red Hat reports:
current CFME code contains dangerous send in cfme/vmdb/app/controllers/applicationcontroller/performance.rb :
747: prpt.whereclause[2] = @perfrecord.send(@perfoptions[:parent].underscore).id
This calls .send method on @perfrecord, with argument @perfoptions[:parent], which is supplied by user:
29: @perfoptions[:parent] = params[:compareto].blank? ? nil : params[:compareto] if params.haskey?(:compareto)
Other sources
vmdb/app/controllers/applicationcontroller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to gain privileges via unspecified vectors, related to an "insecure send method."
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3642?
CVE-2014-3642 is classified as a medium severity vulnerability.
How do I fix CVE-2014-3642?
To remediate CVE-2014-3642, update Red Hat CloudForms Management Engine to version 5.2.5 or later.
What components are affected by CVE-2014-3642?
CVE-2014-3642 affects Red Hat CloudForms Management Engine versions 5.2, 5.2.1, 5.2.2, 5.2.3, 5.2.4, and 5.2.5.
What type of vulnerability is CVE-2014-3642?
CVE-2014-3642 is a code execution vulnerability that arises from unsafe use of the send method.
Who reported CVE-2014-3642?
CVE-2014-3642 was reported by Jan Rusnacko of Red Hat.