CVE-2017-12191

HIGH

Red Hat CloudForms - Improper Access Control via VMware Shared Account

Title source: llm

Description

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

References (2)

Core 2

Core References

Patch, Vendor Advisory vendor-advisory x_refsource_redhat

https://access.redhat.com/errata/RHSA-2018:0374

Issue Tracking, Vendor Advisory x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=1500517

Scores

CVSS v3 7.4

EPSS 0.0089

EPSS Percentile 54.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Details

CWE

CWE-284 CWE-613

Status published

Products (1)

redhat/cloudforms 4.5

Published Feb 28, 2018

Tracked Since Feb 18, 2026