CVE-2015-7502: Infoleak
It is reported that CloudForms fails to protect potentially sensitive data stored in the backend PostgreSQL database. This is due to encrypted data being decrypted and then stashed in data structures which may be inadvertently exposed (e.g. through database log files).
Other sources
Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-7502?
CVE-2015-7502 is classified as a moderate severity vulnerability due to potential local access to sensitive data.
How do I fix CVE-2015-7502?
To fix CVE-2015-7502, you should apply the relevant updates or patches provided by Red Hat for the affected versions of CloudForms.
What versions are affected by CVE-2015-7502?
CVE-2015-7502 affects Red Hat CloudForms versions 3.2, 4.0, and the Management Engine versions 5.4.4 and 5.5.0.
What are the risks associated with CVE-2015-7502?
The risks associated with CVE-2015-7502 include unauthorized access to sensitive data stored in the PostgreSQL database by local users.
Is CVE-2015-7502 related to data encryption?
Yes, CVE-2015-7502 is related to improper encryption of sensitive data in the backend PostgreSQL database.