{"id":"CVE-2014-0136","aliases":["EUVD-2014-0195","GHSA-xf8w-qcq9-6w6f","RHSA-2014:1037"],"status":"published","title":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management...","description":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01567,"percentile":0.75475,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-10-27T01:00:00Z","modified":"2026-06-17T00:02:21Z","fixes":[{"ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme","fixed_in":["0:5.2.5.3-2.el6cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-appliance","fixed_in":["0:5.2.5.3-2.el6cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-debuginfo","fixed_in":["0:5.2.5.3-2.el6cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-lib","fixed_in":["0:5.2.5.3-2.el6cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"mingw32-cfme-host","fixed_in":["0:5.2.5.3-2.el6cf"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.5.3-2.el6cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.5.3-2.el6cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.5.3-2.el6cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"cfme-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.5.3-2.el6cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5::el6","package":"mingw32-cfme-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.2.5.3-2.el6cf"}]}]}],"products":[{"vendor":"redhat","product":"cloudforms_3.0_management_engine"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-1037.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"http://www.securityfocus.com/bid/69233","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0136","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:1037","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076669","tags":["report"]},{"url":"https://github.com/advisories/GHSA-xf8w-qcq9-6w6f"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/CloudForms/3.0/html/Management_Engine_5.2_Technical_Notes/index.html","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/CloudForms/3.0/html/Management_Engine_5.2_Release_Notes/index.html","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1037.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0136","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-0136","description":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.","status":"published","published":"2014-10-27T01:00:00Z","modified":"2024-08-06T09:05:39.026Z","updated_at":"2026-11-02T14:33:46.955592Z"}],"euvd":[{"id":"EUVD-2014-0195","description":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.","status":"published","published":"2014-10-27T01:00:00Z","modified":"2024-08-06T09:05:39Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-xf8w-qcq9-6w6f","title":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management...","description":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.","status":"published","published":"2022-05-17T04:16:56Z","modified":"2023-02-10T05:07:18Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:54:03.896291Z"}],"nvd":[{"id":"CVE-2014-0136","description":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.","status":"published","published":"2014-10-27T01:55:24.157Z","modified":"2026-06-17T00:02:21.82Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:56.921017Z"}],"osv":[{"id":"RHSA-2014:1037","title":"Red Hat Security Advisory: cfme security and bug fix update","status":"published","published":"2024-09-15T21:50:23Z","modified":"2025-11-22T10:53:06Z","updated_at":"2026-11-02T15:53:02.532052Z"}]}}