CVE-2017-7497

low-risk

Published 2018-07-27

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.

Do I need to act?

0.12% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 4.1/10 Medium

NETWORK / HIGH complexity

Affected Products (2)

Cloudforms Management Engine

Affected Vendors

Redhat

References (6)

Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1601

Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1758

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7497

Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1601

Vendor Advisory https://access.redhat.com/errata/RHSA-2017:1758

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7497

/ 100

low-risk

Severity 14/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 7/34 · Low