Improper access control in CloudForms - CVE-2016-5383

Vulnerability identifier: #VU40134

CSH Severity: High

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2016-5383

CWE-ID: CWE-284

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated user to execute arbitrary code.

The web UI in Red Hat CloudForms 4.1 allows remote authenticated users to execute arbitrary code via vectors involving "Lack of field filters."

CloudForms
google-compute-engine (Red Hat package)
google-config (Red Hat package)
cfme (Red Hat package)
cfme-appliance (Red Hat package)
cfme-gemset (Red Hat package)

Install update from vendor's website.

google-compute-engine (Red Hat package) - update to 2.0.0-1.el7cf
google-config (Red Hat package) - update to 2.0.0-1.el7cf
cfme (Red Hat package) - update to 5.6.1.2-1.el7cf
cfme-appliance (Red Hat package) - update to 5.6.1.2-1.el7cf
cfme-gemset (Red Hat package) - update to 5.6.1.2-1.el7cf

• http://rhn.redhat.com/errata/RHSA-2016-1634.html
• http://www.securityfocus.com/bid/92585

• Improper access control in CloudForms
• Red Hat CloudForms 4 update for cfme