CVE-2014-0137 SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitra...
MediumCVSS 6.5
EPSS 1.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
SQL injection vulnerability in the saved_report_delete action in the ReportController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, related to MiqReportResult.exists.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat cloudforms 3.0 management engine | <= 5.2.3 | No fix listed |
| redhat cloudforms 3.0 management engine | = 5.2 | No fix listed |
| redhat cloudforms 3.0 management engine | = 5.2.1 | No fix listed |
| redhat cloudforms 3.0 management engine | = 5.2.2 | No fix listed |
References
- RHSA-2014:0469 vendor-advisory