VULNERABILITY INTELLIGENCE

CVE-2017-7497

CVSS score4.1 MEDIUM
EPSS probability0.99%
CISA KEVNot currently listed
Published2018-07-27
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L

Description

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.

Weakness classification

  • CWE-284: Improper Access Control

Primary references