Permissions, Privileges, and Access Controls in CloudForms - CVE-2012-5604
Published: March 1, 2013 / Updated: August 11, 2020
Vulnerability identifier: #VU43046
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-5604
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The ldap_fluff gem for Ruby, as used in Red Hat CloudForms 1.1, when using Active Directory for authentication, allows remote attackers to bypass authentication via unspecified vectors.
Affected software
CloudForms
How to mitigate CVE-2012-5604
Install update from vendor's website.