CVE-2017-2632
cfme: tenant administrator can create a group with higher permissions
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
Un error lógico en valid_role() en la validación de roles de CloudForms en versiones anteriores a la 5.7.1.3 podría permitir a un administrador inquilino crear grupos con un nivel de privilegios superior al que debería tener el administrador inquilino. Esto permitiría a un atacante con acceso de administración de inquilinos elevar privilegios.
A logic error in valid_role() in CloudForms role validation could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view controller framework for web application development. Action Pack implements the controller and the view components. This update fixes various bugs and adds several enhancements.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2016-12-01 CVE Reserved
- 2017-02-28 CVE Published
- 2024-08-05 CVE Updated
- 2025-05-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-285: Improper Authorization
- CWE-863: Incorrect Authorization
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/96478 | Third Party Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2632 | Issue Tracking |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://rhn.redhat.com/errata/RHSA-2017-0320.html | 2019-10-09 | |
| https://access.redhat.com/security/cve/CVE-2017-2632 | 2017-02-27 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1424977 | 2017-02-27 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Redhat Search vendor "Redhat" | Cloudforms Management Engine Search vendor "Redhat" for product "Cloudforms Management Engine" | < 5.7.1.3 Search vendor "Redhat" for product "Cloudforms Management Engine" and version " < 5.7.1.3" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Cloudforms Search vendor "Redhat" for product "Cloudforms" | 4.2 Search vendor "Redhat" for product "Cloudforms" and version "4.2" | - |
Affected
| ||||||