CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2018-07-26T14:00:00

Updated: 2024-08-05T14:02:07.550Z

Reserved: 2016-12-01T00:00:00

Link: CVE-2017-2664

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2018-07-26T14:29:00.377

Modified: 2024-11-21T03:23:55.937

Link: CVE-2017-2664

cve-icon Redhat

Severity : Important

Publid Date: 2017-08-02T00:00:00Z

Links: CVE-2017-2664 - Bugzilla