CVE-2016-7047: Infoleak
A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access.
Other sources
It was found that The API leaks any MiqReportResult to user that has entitlement to this feature.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-7047?
CVE-2016-7047 is classified as a medium severity vulnerability.
How do I fix CVE-2016-7047?
To fix CVE-2016-7047, upgrade to CloudForms version 5.6.3.0, 5.7.3.1, or 5.8.1.2.
What type of flaw is associated with CVE-2016-7047?
CVE-2016-7047 is an information disclosure vulnerability within the CloudForms API.
Who is affected by CVE-2016-7047?
Users with permissions to the MiqReportResults capability in the CloudForms API prior to the patched versions are affected by CVE-2016-7047.
What can happen if CVE-2016-7047 is exploited?
If exploited, CVE-2016-7047 could allow unauthorized users to view data from other tenants or groups.