VULNERABILITY INTELLIGENCE

CVE-2017-2632

CVSS score4.9 MEDIUM

EPSS probability1.45%

CISA KEVNot currently listed

Published2018-07-27

Last modified2026-06-17

CVSS vectorCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Description

A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higher privilege level than the tenant administrator should have. This would allow an attacker with tenant administration access to elevate privileges.

Weakness classification

CWE-285: Improper Authorization
CWE-863: Incorrect Authorization

Primary references

secalert@redhat.com — Third Party Advisory
secalert@redhat.com — Third Party Advisory, VDB Entry
secalert@redhat.com — Issue Tracking, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Third Party Advisory