CVE-2014-0136

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-0136
The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2014-1037.html Vendor Advisory
http://www.securityfocus.com/bid/69233
Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:cloudforms_3.0_management_engine:*:*:*:*:*:*:*:*
History

13 Feb 2023, 00:32

Type Values Removed Values Added
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-0136', 'name': 'https://access.redhat.com/security/cve/CVE-2014-0136', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:1037', 'name': 'https://access.redhat.com/errata/RHSA-2014:1037', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1076669', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1076669', 'tags': [], 'refsource': 'MISC'}
Summary It was found that the get and log methods of the AgentController wrote log messages without sanitizing user input. A remote attacker could use this flaw to insert arbitrary content into the log files written to by AgentController. The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.

02 Feb 2023, 20:16

Type Values Removed Values Added
Summary The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors. It was found that the get and log methods of the AgentController wrote log messages without sanitizing user input. A remote attacker could use this flaw to insert arbitrary content into the log files written to by AgentController.
References
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-0136 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:1037 -
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1076669 -
Information

Published : 2014-10-27 01:55

Updated : 2023-12-10 11:31

NVD link : CVE-2014-0136

Mitre link : CVE-2014-0136

CVE.ORG link : CVE-2014-0136

JSON object : View

Products Affected

redhat

  • cloudforms_3.0_management_engine
CWE
CWE-20

Improper Input Validation