Vulnerabilities > CVE-2017-12191 - Unspecified vulnerability in Redhat Cloudforms 4.5

047910
CVSS 7.4 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
LOW
Confidentiality impact
LOW
Integrity impact
LOW
Availability impact
LOW
network
low complexity
redhat
NVD
Published: 2018-02-28
Updated: 2024-11-21

Summary

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

Vulnerable Configurations

Part Description Count
Application
Redhat
1

Redhat

advisories
rhsa
idRHSA-2018:0374
rpms
  • ansible-0:2.4.3.0-1.el7ae
  • ansible-tower-server-0:3.1.5-3.el7at
  • ansible-tower-setup-0:3.1.5-3.el7at
  • cfme-0:5.8.3.4-1.el7cf
  • cfme-appliance-0:5.8.3.4-1.el7cf
  • cfme-appliance-debuginfo-0:5.8.3.4-1.el7cf
  • cfme-debuginfo-0:5.8.3.4-1.el7cf
  • cfme-gemset-0:5.8.3.4-1.el7cf
  • postgresql94-0:9.4.15-3PGDG.el7at
  • postgresql94-contrib-0:9.4.15-3PGDG.el7at
  • postgresql94-debuginfo-0:9.4.15-3PGDG.el7at
  • postgresql94-devel-0:9.4.15-3PGDG.el7at
  • postgresql94-docs-0:9.4.15-3PGDG.el7at
  • postgresql94-libs-0:9.4.15-3PGDG.el7at
  • postgresql94-plperl-0:9.4.15-3PGDG.el7at
  • postgresql94-plpython-0:9.4.15-3PGDG.el7at
  • postgresql94-pltcl-0:9.4.15-3PGDG.el7at
  • postgresql94-server-0:9.4.15-3PGDG.el7at
  • postgresql94-test-0:9.4.15-3PGDG.el7at
  • python-crypto-debuginfo-0:2.6.1-16.el7at
  • python-paramiko-0:2.1.1-2.el7ae
  • python-paramiko-doc-0:2.1.1-2.el7ae
  • python2-crypto-0:2.6.1-16.el7at
  • python2-jmespath-0:0.9.0-4.el7ae

References