VulnerabilityModified

CVE-2014-7814

SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter.

MEDIUM 6.5EPSS 1.41%

Does this matter?

Lower severity and a low EPSS score (1.41%). Track it; it rarely justifies an emergency change on its own.

Description

SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter.

CVSS 2.0: 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
EPSS: 1.41% probability · 71th percentile
CISA KEV: Not listed
Weakness: CWE-89
Affected: redhat/cloudforms 3.1 management engine
Source: secalert@redhat.com

References

http://rhn.redhat.com/errata/RHSA-2015-0028.htmlVendor Advisory
http://secunia.com/advisories/62255
http://rhn.redhat.com/errata/RHSA-2015-0028.htmlVendor Advisory
http://secunia.com/advisories/62255

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.