CVE-2014-3489

Red Hat CloudForms Management Engine < 5.2.4.2 - Weak Password Hashing via Hardcoded Salt

Title source: llm
STIX 2.1

Description

lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.

References (2)

Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/68299
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0816.html

Scores

EPSS 0.0159
EPSS Percentile 73.0%

Details

CWE
CWE-255
Status published
Products (7)
redhat/cloudforms_3.0_management_engine 5.2
redhat/cloudforms_3.0_management_engine 5.2.1
redhat/cloudforms_3.0_management_engine 5.2.1.6
redhat/cloudforms_3.0_management_engine 5.2.2
redhat/cloudforms_3.0_management_engine 5.2.3
redhat/cloudforms_3.0_management_engine 5.2.3.2
redhat/cloudforms_3.0_management_engine < 5.2.4
Published Jul 07, 2014
Tracked Since Feb 18, 2026