CVE-2016-4471: High severity red hat cloudforms vulnerability
It was found that attacker having the access to appliance filesystem is able to execute arbitrary code under the same privileges as appliance runs. This issue is present since upstream commit f077196c99feb874e5cba8b93c1f8dfe26421c1b.
Upstream patch:
https://github.com/ManageIQ/manageiq/pull/7856
Other sources
ManageIQ in CloudForms before 4.1 allows remote authenticated users to execute arbitrary code.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-4471?
CVE-2016-4471 is considered a high severity vulnerability that allows arbitrary code execution by an attacker with access to the appliance filesystem.
How do I fix CVE-2016-4471?
To fix CVE-2016-4471, it is recommended to apply the relevant upstream patch from ManageIQ or upgrade to a patched version of Red Hat CloudForms.
Who is affected by CVE-2016-4471?
CVE-2016-4471 affects all versions of Red Hat CloudForms up to and including version 4.0 that are using the vulnerable underlying system.
What are the potential impacts of CVE-2016-4471?
The potential impacts of CVE-2016-4471 include unauthorized code execution, which can lead to data loss, service disruption, or further compromise of the appliance.
Is there a workaround for CVE-2016-4471?
Currently, there are no known workarounds for CVE-2016-4471; applying the patch is the only way to mitigate the vulnerability.