CVE-2014-0087

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-0087
The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
https://bugzilla.redhat.com/show_bug.cgi?id=1067623 Issue Tracking Third Party Advisory
https://github.com/ManageIQ/manageiq/issues/1581 Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:cloudforms_management_engine:*:*:*:*:*:*:*:*
History

13 Feb 2023, 00:31

Type Values Removed Values Added
Summary CVE-2014-0087 CFME: check_privileges logic error resulting in privilege escalation The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-0087', 'name': 'https://access.redhat.com/security/cve/CVE-2014-0087', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:0028', 'name': 'https://access.redhat.com/errata/RHSA-2015:0028', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:16

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-0087 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:0028 -
Summary The check_privileges method in vmdb/app/controllers/application_controller.rb in ManageIQ, as used in Red Hat CloudForms Management Engine (CFME), allows remote authenticated users to bypass authorization and gain privileges by leveraging improper RBAC checking, related to the rbac_user_edit action. CVE-2014-0087 CFME: check_privileges logic error resulting in privilege escalation
Information

Published : 2018-01-11 16:29

Updated : 2023-12-10 12:15

NVD link : CVE-2014-0087

Mitre link : CVE-2014-0087

CVE.ORG link : CVE-2014-0087

JSON object : View

Products Affected

redhat

  • cloudforms_management_engine
CWE
CWE-264

Permissions, Privileges, and Access Controls