CVE-2017-2632: Medium severity red hat cloudforms management engine vulnerability
A logic error in validrole() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2632 vulnerability?
The severity of CVE-2017-2632 vulnerability is medium.
What is the vulnerability ID of the CloudForms vulnerability?
The vulnerability ID of the CloudForms vulnerability is CVE-2017-2632.
How does the logic error in valid_role() impact CloudForms?
The logic error in valid_role() in CloudForms allows a tenant administrator to create groups with a higher privilege level than they should have, enabling an attacker with tenant administration access to elevate privileges.
What software versions are affected by CVE-2017-2632?
CVE-2017-2632 affects Redhat Cloudforms Management Engine versions up to but excluding 5.7.1.3 and Redhat Cloudforms version 4.2.
Where can I find more information about CVE-2017-2632?
You can find more information about CVE-2017-2632 in the following references: [Red Hat Security Advisory](http://rhn.redhat.com/errata/RHSA-2017-0320.html), [SecurityFocus](http://www.securityfocus.com/bid/96478), [Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2632).