{"id":"CVE-2017-7530","aliases":["EUVD-2017-16546","GHSA-hvp5-xq7g-8w42","RHSA-2017:1758"],"status":"published","title":"In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that...","description":"In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01681,"percentile":0.77099,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-862"],"published":"2018-07-26T13:00:00Z","modified":"2026-07-01T10:02:37Z","affected":[{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.0.0-1.el7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"ansible-tower-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"ansible-tower-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el7at"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-appliance-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.8.1.5-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.8::el7","package":"rh-ruby23-rubygem-nokogiri-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.2-1.el7cf"}]}],"bundled":4}],"products":[{"vendor":"red hat","product":"cfme"},{"vendor":"redhat","product":"cloudforms"},{"vendor":"redhat","product":"cloudforms_management_engine"}],"references":[{"url":"http://www.securityfocus.com/bid/100151","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7530","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2017:1758","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7530","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-hvp5-xq7g-8w42"},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1374215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1435393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1438562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1439309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1441321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1444505","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1449273","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450082","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450087","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450150","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450518","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1454445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1455685","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1456017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458341","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458360","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458377","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458434","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458445","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458447","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458892","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458896","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458919","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458921","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458924","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458925","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458926","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458935","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458943","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458947","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1458951","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459217","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459225","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459227","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459247","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459257","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459262","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459264","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459902","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459903","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459923","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459929","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459940","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459944","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459962","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459986","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459989","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1459992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460000","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460002","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460004","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460023","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460027","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460031","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460032","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460034","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460293","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460304","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460316","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460339","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460349","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460359","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460366","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460372","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460382","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460386","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460776","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460781","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460791","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460792","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461142","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460808","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1460809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461070","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461143","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461144","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461161","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461165","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461169","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461183","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461456","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461475","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461485","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461513","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461541","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461558","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461559","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461869","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461958","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1461988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462309","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463321","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1463848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464153","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1464203","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1465448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1466855","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468292","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468294","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468337","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468380","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468700","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1468729","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469560","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1469702","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470773","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1470847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1471821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472841","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473336","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473787","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1474504","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1758.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-7047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-7047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7047","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-2664","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2664","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7497","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7497","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7497","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7530","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7530","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2017-7530","description":"In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).","status":"published","published":"2018-07-26T13:00:00Z","modified":"2024-08-05T16:04:11.87Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:33:20.488433Z"}],"euvd":[{"id":"EUVD-2017-16546","description":"In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).","status":"published","published":"2018-07-26T13:00:00Z","modified":"2024-08-05T16:04:11Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T02:39:08.024596Z"}],"ghsa":[{"id":"GHSA-hvp5-xq7g-8w42","title":"In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that...","description":"In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).","status":"published","published":"2022-05-13T01:36:18Z","modified":"2023-02-01T05:08:56Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T14:50:53.78471Z"}],"nvd":[{"id":"CVE-2017-7530","description":"In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).","status":"published","published":"2018-07-26T13:29:00.247Z","modified":"2026-06-17T01:24:32.613Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"RHSA-2017:1758","title":"Red Hat Security Advisory: Red Hat CloudForms security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:22:18Z","modified":"2026-07-01T10:02:37Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.262457Z"}]}}