Description
Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authenticated users to access sensitive controllers and actions via a direct HTTP or HTTPS request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | certmonger | 0.75.13-1.el6 | RHSA-2014:1317 |
| Red Hat CloudForms 5 | cfme +3 | 5.3.0.15-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | cfme-vnc-plugin | 1.0.0-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | libdnet +2 | 1.12-11.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | lshw +1 | B.02.16-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | mod_authnz_pam +1 | 0.9.2-1.el6 | RHSA-2014:1317 |
| Red Hat CloudForms 5 | mod_intercept_form_submit | 0.9.7-1.el6 | RHSA-2014:1317 |
| Red Hat CloudForms 5 | netapp-manageability-sdk +1 | 4.0P1-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | open-vm-tools +2 | 9.2.3-5.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | prince | 9.0r2-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | pyliblzma | 0.5.3-7.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-Platform | 0.4.0-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-actionpack | 1:3.2.17-6.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-actionwebservice | 1:3.1.0-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-active_hash | 1.3.0-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-activerecord | 1:3.2.17-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-acts_as_list | 0.1.9-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-acts_as_tree | 0.1.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-addressable | 2.2.8-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-akami +2 | 1.2.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-amq-protocol | 1.9.2-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ancestry | 1.2.5-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-arrayfields | 4.9.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-awesome_print | 1.1.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-awesome_spawn | 1.2.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-aws-sdk | 1.11.3-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-binary_struct +1 | 1.0.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-bullet | 4.6.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-bunny +2 | 1.0.7-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-childprocess | 0.3.9-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-chronic | 0.3.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-churn | 0.0.29-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-color | 1.4.1-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-colored | 1.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-crack +1 | 0.3.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-daemons | 1.1.9-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-dalli +1 | 2.2.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-elif | 0.1.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-excon | 0.31.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ezcrypto | 0.7-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-facade +1 | 1.0.5-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-factory_girl | 4.1.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-fastercsv | 1.5.5-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ffi | 1.9.3-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-flay | 2.3.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-flog | 3.2.3-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-fog | 1.19.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-formatador | 0.2.4-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-gssapi +1 | 1.1.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-gyoku +3 | 1.0.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-haml | 4.0.5-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-haml-rails | 0.4-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-handsoap | 0.2.5-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-highline | 1.6.21-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-hirb | 0.7.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-hmac | 0.4.0-7.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-hoe | 2.12.3-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-httparty | 0.10.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-httpclient | 2.2.7-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-httpi +2 | 2.0.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-i18n | 0.6.9-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-io-extra +1 | 1.2.6-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-japgolly-Saikuro | 1.1.1.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-jbuilder | 2.0.7-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-json | 1.8.0-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-json_pure | 1.8.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-libxml-ruby | 2.2.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-linux_admin | 0.9.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-little-plugger | 1.1.3-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-log4r +1 | 1.1.8-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-logging | 1.6.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-mail | 2.5.4-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-main | 4.7.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-map | 6.5.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-metric_fu | 3.0.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-mime-types | 1.20.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-minitest | 3.2.0-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-multi_json | 1.7.7-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-multi_xml | 0.5.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-net-ldap | 0.7.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-net-ping | 1.7.4-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-net-sftp | 2.0.5-7.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-net-ssh | 2.9.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-netrc | 0.7.7-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-nokogiri | 1.5.6-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-nori +1 | 2.1.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-open4 | 1.3.0-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-outfielding-jqplot-rails | 1.0.8-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-parallel | 0.5.21-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-pg | 0.12.2-5.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-progressbar | 0.11.0-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-prototype-rails | 3.2.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-qpid_messaging | 0.20.2-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rack | 1:1.4.5-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rack-test | 0.6.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rails +5 | 1:3.2.17-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rails_best_practices | 1.13.8-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rake | 10.1.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rake-compiler | 0.8.3-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rbovirt | 0.0.17-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rbvmomi | 1.2.3-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rdoc | 3.12.2-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-reek | 1.3.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rest-client | 1.6.7-5.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-roodi +1 | 2.2.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rspec | 2.12.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rspec-core | 2.12.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rspec-fire | 1.3.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rspec-mocks +2 | 2.12.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ruby-graphviz | 1.0.9-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ruby-plsql | 0.4.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ruby-prof | 0.13.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ruby-progressbar | 0.0.10-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ruby2ruby | 2.0.6-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ruby_parser | 3.1.3-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rubyforge | 2.0.4-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rubyntlm +1 | 0.4.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rubyrep | 1.2.0-6.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rubywbem | 0.1.0-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rubyzip | 0.9.5-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-rufus-scheduler | 2.0.19-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ruport | 1.7.0-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-secure_headers | 1.1.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-selenium-webdriver | 2.32.1-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-sexp_processor | 4.2.1-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-shindo | 0.3.4-7.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-simple-rss | 1.2.3-8.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-simplecov | 0.7.1-6.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-simplecov-html | 0.7.1-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-simplecov-rcov | 0.2.3-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-simplecov-rcov-text | 0.0.2-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-slim | 1.3.9-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-snmp | 1.1.0-6.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-soap4r | 1.6.0-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-state_machine | 1.1.2-8.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-syntax | 1.0.0-8.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-temple | 0.6.5-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-terminal-table | 1.4.5-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-test-spec | 0.10.0-7.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-test-unit | 2.4.5-5.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-thin | 1.3.1-5.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-timecop | 0.5.3-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-transaction-simple | 1.4.0-5.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-trollop | 1.16.2-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-uuidtools | 2.1.3-3.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-vcr +1 | 2.4.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-wasabi | 3.1.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-webmock | 1.11.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-winrm | 1.1.3-4.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-xml-simple | 1.0.12-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-xpath +1 | 2.0.0-1.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | ruby193-rubygem-ziya | 2.3.0-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | selinux-policy +1 | 3.7.19-244.el6 | RHSA-2014:1317 |
| Red Hat CloudForms 5 | sneakernet_ca | 0.1-2.el6cf | RHSA-2014:1317 |
| Red Hat CloudForms 5 | sssd +20 | 1.11.6-3.el6 | RHSA-2014:1317 |
Advisories 1
- RHSA-2014:1317 Red Hat Security Advisory: cfme security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2014:1317 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1077359