CVE-2013-6443

Red Hat CloudForms Management Engine < 5.2.1.6 - Cross-Site Request Forgery via Ruby on Rails Bypass

Title source: llm
STIX 2.1

Description

CloudForms 3.0 Management Engine before 5.2.1.6 allows remote attackers to bypass the Ruby on Rails protect_from_forgery mechanism and conduct cross-site request forgery (CSRF) attacks via a destructive action in a request.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1029606
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0025.html

Scores

EPSS 0.0060
EPSS Percentile 44.6%

Details

CWE
CWE-352
Status published
Products (3)
redhat/cloudforms 3.0
redhat/cloudforms_3.0_management_engine 5.2
redhat/cloudforms_3.0_management_engine < 5.2.1
Published Jan 23, 2014
Tracked Since Feb 18, 2026