CVE-2016-7071 – CFME: bypass authorization by altering VM ID

https://notcve.org/view.php?id=CVE-2016-7071

It was found that the CloudForms before 5.6.2.2, and 5.7.0.7 did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM. Se ha descubierto que CloudForms en versiones anteriores a la 5.6.2.2 y versiones 5.7.0.7 no aplicó correctamente controles de permisos a los ID de las máquinas virtuales pasados por los usuarios. Un atacante autenticado remoto podría emplear este error para ejecutar máquinas virtuales en sistemas gestionados por CloudForms si conoce el ID de la máquina It was found that the CloudForms did not properly apply permissions controls to VM IDs passed by users. A remote, authenticated attacker could use this flaw to execute arbitrary VMs on systems managed by CloudForms if they know the ID of the VM. • http://rhn.redhat.com/errata/RHSA-2016-2091.html https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7071 https://access.redhat.com/security/cve/CVE-2016-7071 https://bugzilla.redhat.com/show_bug.cgi?id=1383124 • CWE-285: Improper Authorization •