Every CVE Search/ Get API key

CVE-2017-12191

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared...

7.4 HighFix available

CVE-2017-12191 is a high vulnerability (CVSS 7.4) in [unknown] Cloudforms, published February 28, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in ansible 0:2.4.3.0-1.el7ae.

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

0.88%Up 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.4

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

Record
CVE-2017-12191
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-284, CWE-613
Updated
2026-11-02
CVE List No score

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

Record
CVE-2017-12191
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2017-3766 No score

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

Record
EUVD-2017-3766
Updated
2026-11-03
GitHub AdvisoriesGHSA-cfmg-g9hg-m3g2 7.4

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared...

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

Record
GHSA-cfmg-g9hg-m3g2
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-284, CWE-613
Updated
2026-11-02
OSVRHSA-2018:0374 7.4

Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update

Record
RHSA-2018:0374
CVSS 3.0
7.4 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
ansible
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:2.4.3.0-1.el7ae
0:2.4.3.0-1.el7ae
ansible-tower-server
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:3.1.5-3.el7at
0:3.1.5-3.el7at
ansible-tower-setup
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:3.1.5-3.el7at
0:3.1.5-3.el7at
cfme
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:5.8.3.4-1.el7cf
0:5.8.3.4-1.el7cf
cfme-appliance
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:5.8.3.4-1.el7cf
0:5.8.3.4-1.el7cf
cfme-appliance-debuginfo
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:5.8.3.4-1.el7cf
0:5.8.3.4-1.el7cf
cfme-debuginfo
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:5.8.3.4-1.el7cf
0:5.8.3.4-1.el7cf
cfme-gemset
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:5.8.3.4-1.el7cf
0:5.8.3.4-1.el7cf
postgresql94
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-contrib
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
Show 16 moreShow less
Affected packages
PackageAffectedFixed
postgresql94-debuginfo
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-devel
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-docs
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-libs
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-plperl
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-plpython
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-pltcl
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-server
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
postgresql94-test
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:9.4.15-3PGDG.el7at
0:9.4.15-3PGDG.el7at
python-crypto
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:2.6.1-16.el7at
0:2.6.1-16.el7at
python-crypto-debuginfo
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:2.6.1-16.el7at
0:2.6.1-16.el7at
python-jmespath
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:0.9.0-4.el7ae
0:0.9.0-4.el7ae
python-paramiko
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:2.1.1-2.el7ae
0:2.1.1-2.el7ae
python-paramiko-doc
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:2.1.1-2.el7ae
0:2.1.1-2.el7ae
python2-crypto
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:2.6.1-16.el7at
0:2.6.1-16.el7at
python2-jmespath
Red Hat:cloudforms_managementengine:5.8::el7
 before 0:0.9.0-4.el7ae
0:0.9.0-4.el7ae

History

History
WhenChangedSources
2026-11-03aliases, productsEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 190 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open