CVE-2014-0078
Fixed in a distro release EPSS 1%
The CatalogController in Red Hat CloudForms Management Engine (CFME) before 5.2.3.2 allows remote authenticated users to delete arbitrary catalogs via vectors involving guessing the catalog ID.
Products: redhat cloudforms_3.0_management_engine
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat cloudforms managementengine 5 | cfme | 0:5.2.3.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-appliance | 0:5.2.3.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-debuginfo | 0:5.2.3.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | cfme-lib | 0:5.2.3.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | mingw32-cfme-host | 0:5.2.3.2-1.el6cf |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-contrib | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-debuginfo | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-devel | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-docs | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-libs | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-plperl | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-plpython | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-pltcl | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-server | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-test | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | postgresql92-postgresql-upgrade | 0:9.2.7-1.1.el6 |
| Red Hat cloudforms managementengine 5 | prince | 0:9.0r2-4.el6cf |
| Red Hat cloudforms managementengine 5 | ruby193-rubygem-actionpack | 1:3.2.13-6.el6cf |