CVE-2017-2632 A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have.....
MediumCVSS 4.9
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat cloudforms management engine | < 5.7.1.3 | 5.7.1.3 |
| redhat cloudforms | = 4.2 | No fix listed |
| redhat cfme | = 5.7.1.3 | No fix listed |
References
- RHSA-2017:0320 third-party-advisory vendor-advisory
- 96478 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory