VulnerabilityModified

CVE-2014-0078

The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

MEDIUM 4.0EPSS 1.02%

Does this matter?

Lower severity and a low EPSS score (1.02%). Track it; it rarely justifies an emergency change on its own.

Description

The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.

CVSS 2.0: 4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
EPSS: 1.02% probability · 61th percentile
CISA KEV: Not listed
Weakness: CWE-264
Affected: redhat/cloudforms 3.0 management engine
Source: secalert@redhat.com

References

http://rhn.redhat.com/errata/RHSA-2014-0469.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1064556
http://rhn.redhat.com/errata/RHSA-2014-0469.htmlVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1064556

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.