CVE-2017-7497

Medium

Description

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.

SeverityMedium

CVSS4.1

Exploit probability—

Product

Redhat Cloudforms Management Engine

PublishedJul 27, 2018

First seenJul 27, 2018

Weakness typeCWE-284Improper access control

How to fix

Vendor advisories

access.redhat.com/errata/RHSA-2017:1601
access.redhat.com/errata/RHSA-2017:1758

Affected products

Product	Affected versions	Fixed in
redhat cloudforms_management_engine	5.7.2, 5.8.0	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.