CVE-2014-0184 - Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying

CVE-2014-0184

Summary

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

References

http://rhn.redhat.com/errata/RHSA-2014-0816.html

Vulnerable Configurations

cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.1:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:-:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.1.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.1.6:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.3:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.3.2:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.4:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cloudforms_3.0_management_engine:5.2.4:*:*:*:*:*:*:*

CVSS

Base:	4.9 (as of 13-02-2023 - 00:35)
Impact:
Exploitability:

CWE

CWE-255

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	NONE	NONE

cvss-vector via4

AV:L/AC:L/Au:N/C:C/I:N/A:N

redhat via4

advisories

rhsa

id	RHSA-2014:0816

rpms

cfme-0:5.2.4.2-1.el6cf
cfme-appliance-0:5.2.4.2-1.el6cf
cfme-debuginfo-0:5.2.4.2-1.el6cf
cfme-lib-0:5.2.4.2-1.el6cf
mingw32-cfme-host-0:5.2.4.2-1.el6cf
ruby193-rubygem-actionpack-1:3.2.13-8.el6cf

refmap via4

Last major update

13-02-2023 - 00:35

Published

07-07-2014 - 14:55

Last modified

13-02-2023 - 00:35