CVE-2014-0078

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-0078
The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2014-0469.html Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1064556
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:cloudforms_3.0_management_engine:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.2:*:*:*:*:*:*:*
History

13 Feb 2023, 00:31

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-0078', 'name': 'https://access.redhat.com/security/cve/CVE-2014-0078', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:0469', 'name': 'https://access.redhat.com/errata/RHSA-2014:0469', 'tags': [], 'refsource': 'MISC'}
Summary CVE-2014-0078 CFME: multiple authorization bypass vulnerabilities in CatalogController The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

02 Feb 2023, 20:16

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-0078 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:0469 -
Summary The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID. CVE-2014-0078 CFME: multiple authorization bypass vulnerabilities in CatalogController
Information

Published : 2014-05-14 19:55

Updated : 2023-12-10 11:31

NVD link : CVE-2014-0078

Mitre link : CVE-2014-0078

CVE.ORG link : CVE-2014-0078

JSON object : View

Products Affected

redhat

  • cloudforms_3.0_management_engine
CWE
CWE-264

Permissions, Privileges, and Access Controls