CVE-2017-7530: High severity redhat Cloudforms vulnerability
In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7530?
CVE-2017-7530 is classified as a medium severity vulnerability due to the potential unauthorized access to execute privileged actions.
How do I fix CVE-2017-7530?
To fix CVE-2017-7530, update CloudForms Management Engine to version 5.7.3 or 5.8.1 or later.
What types of software are affected by CVE-2017-7530?
CVE-2017-7530 affects Red Hat CloudForms Management Engine versions prior to 5.7.3 and versions in the 5.8.x series before 5.8.1.
What can an attacker do with CVE-2017-7530?
An attacker exploiting CVE-2017-7530 can invoke arbitrary methods on virtual machines, potentially allowing them to execute unauthorized actions.
Is CVE-2017-7530 still a concern for users of affected software?
Yes, CVE-2017-7530 remains a concern for users who have not yet updated their affected versions of the CloudForms Management Engine.