Permissions, Privileges, and Access Controls in CloudForms



Published: 2013-03-01 | Updated: 2020-08-11
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2012-5604
CWE-ID CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		CloudForms
Client/Desktop applications / Multimedia software

Vendor Red Hat Inc.

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Permissions, Privileges, and Access Controls

EUVDB-ID: #VU43046

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2012-5604

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to manipulate data.

The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors.

Mitigation

Install update from vendor's website.

Vulnerable software versions

CloudForms: 1.1

External links

http://rhn.redhat.com/errata/RHSA-2013-0544.html
http://bugzilla.redhat.com/show_bug.cgi?id=882136


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###