CVE-2016-7047 Missing authorization in cfme

Medium 4.3 Published 11 Sep 2018 Updated 6 Aug 2024

Users with specific API permissions can view data from other tenants or groups, leading to unauthorized information disclosure.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2016-7047?

CVE-2016-7047 is a medium-severity missing authorization vulnerability in Red Hat cfme, published on 11 Sep 2018. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access.

Weakness: CWE-200

Which versions are affected by CVE-2016-7047?

It affects 2 products.

Products include Redhat Cloudforms, Redhat Cloudforms Management Engine.

How do I fix CVE-2016-7047?

Upgrade to a fixed version.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2016-7047 being exploited?

There is no known exploitation of CVE-2016-7047 in the wild and no public exploit code.

Sources

Also known as GHSA-2499-9m7g-hrw5.