{"id":"CVE-2017-2664","aliases":["EUVD-2017-11811","GHSA-rc49-fxf8-jgg2","RHSA-2017:1758","RHSA-2017:3484"],"status":"published","title":"CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on...","description":"CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01302,"percentile":0.7067,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2018-07-26T14:00:00Z","modified":"2026-07-01T10:03:12Z","fixes":[{"ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme","fixed_in":["0:5.7.4.2-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme-appliance","fixed_in":["0:5.7.4.2-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme-appliance-debuginfo","fixed_in":["0:5.7.4.2-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme-debuginfo","fixed_in":["0:5.7.4.2-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme-gemset","fixed_in":["0:5.7.4.2-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"rh-ruby23-rubygem-nokogiri","fixed_in":["0:1.8.1-2.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"rh-ruby23-rubygem-nokogiri-debuginfo","fixed_in":["0:1.8.1-2.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"rh-ruby23-rubygem-nokogiri-doc","fixed_in":["0:1.8.1-2.el7cf"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0.0-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"ansible-tower-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"ansible-tower-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-appliance-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.7.4.2-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.7.4.2-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme-appliance-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.7.4.2-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.7.4.2-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.7.4.2-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"rh-ruby23-rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-2.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"rh-ruby23-rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-2.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.7::el7","package":"rh-ruby23-rubygem-nokogiri-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.1-2.el7cf"}]}]}],"products":[{"vendor":"[unknown]","product":"cloudforms"},{"vendor":"red hat","product":"cloudforms"},{"vendor":"redhat","product":"cloudforms"},{"vendor":"redhat","product":"cloudforms_management_engine"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2017:3484","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/100148","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1758","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2664","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2664","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-rc49-fxf8-jgg2"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1435393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1438562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1444505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450150","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458360","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458919","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458925","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458951","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459227","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459902","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459923","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459944","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460031","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460293","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460792","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461558","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464203","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1474504","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1758.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7047","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2664","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2664","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7497","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7497","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7497","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7530","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7530","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7530","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1344690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1401560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1424267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1429962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1440105","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449404","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1451831","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1457979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460149","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462104","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465086","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465093","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468633","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471204","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471315","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473271","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1475031","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476279","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476284","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1476395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477195","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477617","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1477727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1478368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1479410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1480630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481859","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1481870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1482672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1484549","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487686","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1487694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1490434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1491576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1492158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1492867","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1493700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1494189","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1495971","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1496597","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1497748","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1498232","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500067","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1500995","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1501478","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1502739","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505458","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1505546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1509420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1517712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1521043","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3484.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-2664","description":"CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.","status":"published","published":"2018-07-26T14:00:00Z","modified":"2024-08-05T14:02:07.55Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:33:15.887816Z"}],"euvd":[{"id":"EUVD-2017-11811","description":"CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.","status":"published","published":"2018-07-26T14:00:00Z","modified":"2024-08-05T14:02:07Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:20.035866Z"}],"ghsa":[{"id":"GHSA-rc49-fxf8-jgg2","title":"CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on...","description":"CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.","status":"published","published":"2022-05-13T01:36:51Z","modified":"2023-02-01T05:09:03Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:50:54.417127Z"}],"nvd":[{"id":"CVE-2017-2664","description":"CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1 lacks RBAC controls on certain methods in the rails application portion of CloudForms. An attacker with access could use a variety of methods within the rails application portion of CloudForms to escalate privileges.","status":"published","published":"2018-07-26T14:29:00.377Z","modified":"2026-06-17T01:16:36.84Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"RHSA-2017:1758","title":"Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:22:18Z","modified":"2026-07-01T10:02:37Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"},{"id":"RHSA-2017:3484","title":"Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:22:23Z","modified":"2026-07-01T10:03:12Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"}]}}