CVE-2015-7502

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-7502
Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.

5.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability : 1.4 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
http://rhn.redhat.com/errata/RHSA-2015-2620.html Vendor Advisory
https://access.redhat.com/errata/RHSA-2015:2551 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1283019 Vendor Advisory
Configurations

Configuration 1 (hide)

AND
cpe:2.3:a:redhat:cloudforms_management_engine:5.4.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms:3.2:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:a:redhat:cloudforms:4.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_management_engine:5.5.0:*:*:*:*:*:*:*
History

13 Feb 2023, 00:53

Type Values Removed Values Added
Summary A privilege escalation flaw was discovered in CloudForms, where in certain situations, CloudForms could read encrypted data from the database and then write decrypted data back into the database. If the database was then exported or log files generated, a local attacker might be able to gain access to sensitive information. Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2620', 'name': 'https://access.redhat.com/errata/RHSA-2015:2620', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-7502', 'name': 'https://access.redhat.com/security/cve/CVE-2015-7502', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:15

Type Values Removed Values Added
References
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2620 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-7502 -
Summary Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files. A privilege escalation flaw was discovered in CloudForms, where in certain situations, CloudForms could read encrypted data from the database and then write decrypted data back into the database. If the database was then exported or log files generated, a local attacker might be able to gain access to sensitive information.
Information

Published : 2016-04-11 21:59

Updated : 2023-12-10 11:46

NVD link : CVE-2015-7502

Mitre link : CVE-2015-7502

CVE.ORG link : CVE-2015-7502

JSON object : View

Products Affected

redhat

  • cloudforms_management_engine
  • cloudforms
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor