CVE-2018-10905: OS Command Injection
First published: Wed Jul 18 2018(Updated: )
CloudForms Management Engine (cfme) is vulnerable to an improper security setting in the dRuby component of CloudForms. An attacker with access to an unprivileged local shell could use this flaw to execute commands as a high privileged user.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/cfme | <5.8.5.0 | 5.8.5.0 |
| redhat/cfme | <5.9.4.2 | 5.9.4.2 |
| Redhat Cloudforms | =4.5 | |
| Redhat Cloudforms | =4.6 | |
| Redhat Cloudforms Management Engine | =5.8 | |
| Redhat Cloudforms Management Engine | =5.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2018-10905.
What is affected by vulnerability CVE-2018-10905?
CloudForms Management Engine (cfme) versions 5.8.5.0 and 5.9.4.2, as well as Redhat Cloudforms versions 4.5 and 4.6, and Redhat Cloudforms Management Engine versions 5.8 and 5.9 are affected.
What is the severity of CVE-2018-10905?
The severity of CVE-2018-10905 is high (CVSS score of 7).
How can an attacker exploit CVE-2018-10905?
By having access to an unprivileged local shell, an attacker could exploit this vulnerability to execute commands as a high privileged user.
Are there any remediation steps available for CVE-2018-10905?
Yes, the recommended remedy is to update CloudForms Management Engine to version 5.8.5.0 or 5.9.4.2, or update Redhat Cloudforms to version 4.5 or 4.6, or update Redhat Cloudforms Management Engine to version 5.8 or 5.9.
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-10905
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/redhat
- canonical/redhat cloudforms
- version/redhat cloudforms/4.5
- version/redhat cloudforms/4.6
- canonical/redhat cloudforms management engine
- version/redhat cloudforms management engine/5.8
- version/redhat cloudforms management engine/5.9
- package-manager/redhat