CVE-2017-7530

Severity: high (CVSS 8.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-26 · updated 2026-06-17
Weakness: CWE-862

Description

In CloudForms Management Engine (cfme) before 5.7.3 and 5.8.x before 5.8.1, it was found that privilege check is missing when invoking arbitrary methods via filtering on VMs that MiqExpression will execute that is triggerable by API users. An attacker could use this to execute actions they should not be allowed to (e.g. destroying VMs).

Affected products

CloudForms: 4.5
Red Hat CloudForms: before 5.7.3; from 5.8.0 before 5.8.1 — fixed in 5.7.3, 5.8.1

How to fix

Upgrade to a fixed version: Red Hat CloudForms 5.7.3, 5.8.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/100151
https://access.redhat.com/errata/RHSA-2017:1758
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7530
http://www.securityfocus.com/bid/100151
https://access.redhat.com/errata/RHSA-2017:1758
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7530

Get alerted when CVE-2017-7530 or the next vulnerability affects your stack