CVE-2014-0197

CFME: CSRF protection vulnerability via permissive check of the referrer header

8.8 High

CVE-2014-0197 is a high vulnerability (CVSS 8.8) in Cfme, published December 13, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 53rd percentile. No source names a fixed version.

What does this mean?

Severity: 8.8 HighCVSS 3.1, NVD
Exploit chance: 0.68%EPSS, 53rd percentile
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: No fix listedNo source names one

Description

CFME: CSRF protection vulnerability via permissive check of the referrer header

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.68%Down 0.2 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`cfme` Red Hat:cloudforms_managementengine:5::el6 From an advisory covering 7 CVEs	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`cfme-appliance` Red Hat:cloudforms_managementengine:5::el6 From an advisory covering 7 CVEs	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`cfme-debuginfo` Red Hat:cloudforms_managementengine:5::el6 From an advisory covering 7 CVEs	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`cfme-lib` Red Hat:cloudforms_managementengine:5::el6 From an advisory covering 7 CVEs	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`mingw32-cfme-host` Red Hat:cloudforms_managementengine:5::el6 From an advisory covering 7 CVEs	before 0:5.2.4.2-1.el6cf	0:5.2.4.2-1.el6cf
`ruby193-rubygem-actionpack` Red Hat:cloudforms_managementengine:5::el6 From an advisory covering 7 CVEs	before 1:3.2.13-8.el6cf	1:3.2.13-8.el6cf