RCE in Redhat Cloudforms
CVE-2014-0057
The x_button method in the ServiceController (vmdb/app/controllers/service_controller.rb) in Red Hat CloudForms 3.0 Management Engine 5.2 allows remote attackers to execute arbitrary methods via unspecified vectors.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.007 (72.5th percentile) — read the EPSS interpretation.
Affected products
- Redhat Cloudforms — versions 3.0
- Redhat Cloudforms_3.0_management_engine — versions 5.2
- N/a — versions n/a
Weakness classification (CWE)
References
- RHSA-2014:0215 (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM)
- 57376 (x_refsource_SECUNIA, third-party-advisory, Vendor Advisory)