Description
A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | CloudForms | 5.7.2.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | cfme +2 | 5.7.2.1-1.el7cf | RHSA-2017:0898 |
Advisories 1
- RHSA-2017:0898 Red Hat Security Advisory: cfme, cfme-appliance, and cfme-gemset security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 8, 2026
References
- RHSA-2017:0898 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2653
- 96964 vdb-entry