CVE-2017-15123
Last modified
CVE-2017-15123 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.. EPSS estimates a 1.43% chance of exploitation in the next 30 days.
Description
A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.
Metrics
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Cloudforms Management Engine | >= 5.8, <= 5.10 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123Issue Tracking, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-15123?
How severe is CVE-2017-15123?
How do I fix CVE-2017-15123?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-15117Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
- CVE-2017-15118A stack-based buffer overflow vulnerability was found in NBD…8.3
- CVE-2017-15119The Network Block Device (NBD) server in Quick Emulator (QEM…5.8
- CVE-2017-15120An issue has been found in the parsing of authoritative answ…7.5
- CVE-2017-15121A non-privileged user is able to mount a fuse filesystem on …
- CVE-2017-15122Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2017-15124VNC server implementation in Quick Emulator (QEMU) 2.11.0 an…
- CVE-2017-15125A flaw was found in CloudForms before 5.9.0.22 in the self-s…6.5
- CVE-2017-15126A use-after-free flaw was found in fs/userfaultfd.c in the L…8.1
- CVE-2017-15127A flaw was found in the hugetlb_mcopy_atomic_pte function in…
- CVE-2017-15128A flaw was found in the hugetlb_mcopy_atomic_pte function in…
- CVE-2017-15129A use-after-free vulnerability was found in network namespac…4.7
Are you affected by CVE-2017-15123?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST