CVE-2015-7544

CRITICAL

Red Hat Enterprise Virtualization Manager <3.6 - Command Injection

Title source: llm
STIX 2.1

Description

redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.

References (2)

Core 2
Core References
Vendor Advisory vendor-advisory x_refsource_redhat
https://rhn.redhat.com/errata/RHSA-2016-0426.html
Issue Tracking, Vendor Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1269588

Scores

CVSS v3 9.1
EPSS 0.0344
EPSS Percentile 87.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Details

CWE
CWE-74
Status published
Products (3)
redhat/enterprise_virtualization_manager 3.4
redhat/enterprise_virtualization_manager 3.4.1
redhat/enterprise_virtualization_manager 3.5.0
Published Sep 25, 2017
Tracked Since Feb 18, 2026