CVE-2015-7544 Command injection in n/a

What is CVE-2015-7544?

CVE-2015-7544 is a critical command injection vulnerability in n/a, published on 25 Sep 2017. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment.

Weakness: CWE-74

Which versions are affected by CVE-2015-7544?

It affects 1 product.

Products include Redhat Enterprise Virtualization Manager.

How do I fix CVE-2015-7544?

Apply the vendor's patch.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2015-7544 being exploited?

There is no known exploitation of CVE-2015-7544 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2015-0237 Missing authorization in n/a Medium 6.8
• CVE-2012-0861 Security feature bypass in n/a Medium 6.8
• CVE-2010-2793 Race condition in n/a Medium 6.8
• CVE-2014-3573 XML external entity in n/a Medium 6.5
• CVE-2012-0860 Path traversal in n/a Medium 6.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w3v3-p323-g553, RHSA-2016:0426.