Description
CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | cfme +3 | 5.2.1.8-1.el6cf | RHSA-2014:0025 |
| Red Hat CloudForms 5 | ruby193-rubygem-activerecord | 1:3.2.13-4.el6cf | RHSA-2014:0025 |
| Red Hat CloudForms 5 | ruby193-rubygem-linux_admin | 0.5.6-1.el6cf | RHSA-2014:0025 |
Advisories 1
- RHSA-2014:0025 Red Hat Security Advisory: cfme security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- 1029606 vdb-entry
- RHSA-2014:0025 vendor-advisory