Every CVE Search/ Get API key

CVE-2015-7502

Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME)...

5.1 MediumFix available

Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.34%Down 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 5.1

Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.

Record
CVE-2015-7502
CVSS 3.0
5.1 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
1.9 LowAV:L/AC:M/Au:N/C:P/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02
CVE List No score

Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.

Record
CVE-2015-7502
Updated
2026-11-02
EUVDEUVD-2015-7424 No score

Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.

Record
EUVD-2015-7424
Updated
2026-11-03
GitHub AdvisoriesGHSA-vhf3-65mf-c545 5.1

Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME)...

Red Hat CloudForms 3.2 Management Engine (CFME) 5.4.4 and CloudForms 4.0 Management Engine (CFME) 5.5.0 do not properly encrypt data in the backend PostgreSQL database, which might allow local users to obtain sensitive data and consequently gain privileges by leveraging access to (1) database exports or (2) log files.

Record
GHSA-vhf3-65mf-c545
CVSS 3.0
5.1 MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-200
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
cfme
Red Hat:cloudforms_managementengine:5::el7
 before 0:5.5.0.13-2.el7cf
0:5.5.0.13-2.el7cf
cfme-appliance
Red Hat:cloudforms_managementengine:5::el7
 before 0:5.5.0.13-1.el7cf
0:5.5.0.13-1.el7cf
cfme-appliance-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:5.5.0.13-1.el7cf
0:5.5.0.13-1.el7cf
cfme-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:5.5.0.13-2.el7cf
0:5.5.0.13-2.el7cf
cfme-gemset
Red Hat:cloudforms_managementengine:5::el7
 before 0:5.5.0.13-1.el7cf
0:5.5.0.13-1.el7cf
prince
Red Hat:cloudforms_managementengine:5::el7
 before 0:9.0r2-10.el7cf
0:9.0r2-10.el7cf
rh-ruby22-rubygem-bcrypt
Red Hat:cloudforms_managementengine:5::el7
 before 0:3.1.10-3.el7cf
0:3.1.10-3.el7cf
rh-ruby22-rubygem-bcrypt-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:3.1.10-3.el7cf
0:3.1.10-3.el7cf
rh-ruby22-rubygem-escape_utils
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.1.0-2.el7cf
0:1.1.0-2.el7cf
rh-ruby22-rubygem-escape_utils-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.1.0-2.el7cf
0:1.1.0-2.el7cf
Show 34 moreShow less
Affected packages
PackageAffectedFixed
rh-ruby22-rubygem-eventmachine
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.0.7-6.el7cf
0:1.0.7-6.el7cf
rh-ruby22-rubygem-eventmachine-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.0.7-6.el7cf
0:1.0.7-6.el7cf
rh-ruby22-rubygem-ffi
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.9.8-4.el7cf
0:1.9.8-4.el7cf
rh-ruby22-rubygem-ffi-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.9.8-4.el7cf
0:1.9.8-4.el7cf
rh-ruby22-rubygem-json
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.8.2-9.el7cf
0:1.8.2-9.el7cf
rh-ruby22-rubygem-json-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.8.2-9.el7cf
0:1.8.2-9.el7cf
rh-ruby22-rubygem-linux_block_device
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.1.0-2.el7cf
0:0.1.0-2.el7cf
rh-ruby22-rubygem-linux_block_device-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.1.0-2.el7cf
0:0.1.0-2.el7cf
rh-ruby22-rubygem-memory_buffer
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.1.0-2.el7cf
0:0.1.0-2.el7cf
rh-ruby22-rubygem-memory_buffer-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.1.0-2.el7cf
0:0.1.0-2.el7cf
rh-ruby22-rubygem-net_app_manageability
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.1.0-3.el7cf
0:0.1.0-3.el7cf
rh-ruby22-rubygem-net_app_manageability-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.1.0-3.el7cf
0:0.1.0-3.el7cf
rh-ruby22-rubygem-nokogiri
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.6.6.2-3.el7cf
0:1.6.6.2-3.el7cf
rh-ruby22-rubygem-nokogiri-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.6.6.2-3.el7cf
0:1.6.6.2-3.el7cf
rh-ruby22-rubygem-pg
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.18.2-2.el7cf
0:0.18.2-2.el7cf
rh-ruby22-rubygem-pg-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.18.2-2.el7cf
0:0.18.2-2.el7cf
rh-ruby22-rubygem-psych
Red Hat:cloudforms_managementengine:5::el7
 before 0:2.0.13-4.el7cf
0:2.0.13-4.el7cf
rh-ruby22-rubygem-psych-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:2.0.13-4.el7cf
0:2.0.13-4.el7cf
rh-ruby22-rubygem-puma
Red Hat:cloudforms_managementengine:5::el7
 before 0:2.13.4-2.el7cf
0:2.13.4-2.el7cf
rh-ruby22-rubygem-puma-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:2.13.4-2.el7cf
0:2.13.4-2.el7cf
rh-ruby22-rubygem-redhat_access_cfme
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.0.7-1.el7cf
0:0.0.7-1.el7cf
rh-ruby22-rubygem-redhat_access_lib
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.0.6-1.el7cf
0:0.0.6-1.el7cf
rh-ruby22-rubygem-thin
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.6.3-2.el7cf
0:1.6.3-2.el7cf
rh-ruby22-rubygem-thin-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.6.3-2.el7cf
0:1.6.3-2.el7cf
rh-ruby22-rubygem-unf_ext
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.0.7.1-3.el7cf
0:0.0.7.1-3.el7cf
rh-ruby22-rubygem-unf_ext-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.0.7.1-3.el7cf
0:0.0.7.1-3.el7cf
rh-ruby22-rubygem-unf_ext-doc
Red Hat:cloudforms_managementengine:5::el7
 before 0:0.0.7.1-3.el7cf
0:0.0.7.1-3.el7cf
wmi
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.3.14-6.el7cf
0:1.3.14-6.el7cf
wmi-debuginfo
Red Hat:cloudforms_managementengine:5::el7
 before 0:1.3.14-6.el7cf
0:1.3.14-6.el7cf
cfme
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.4.4.2-1.el6cf
0:5.4.4.2-1.el6cf
cfme-appliance
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.4.4.2-1.el6cf
0:5.4.4.2-1.el6cf
cfme-debuginfo
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.4.4.2-1.el6cf
0:5.4.4.2-1.el6cf
cfme-gemset
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.4.4.2-1.el6cf
0:5.4.4.2-1.el6cf
cfme-lib
Red Hat:cloudforms_managementengine:5::el6
 before 0:5.4.4.2-1.el6cf
0:5.4.4.2-1.el6cf

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-7502 is a medium vulnerability (CVSS 5.1) in Redhat Cloudforms, published April 11, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. Fixed in cfme 0:5.5.0.13-2.el7cf.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 360 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open