CVE-2019-14894 Command injection in CloudForms
Authenticated attackers can execute arbitrary shell commands as root via NFS schedule backup in CloudForms management engine.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-14894?
CVE-2019-14894 is a high-severity command injection vulnerability in [UNKNOWN] CloudForms, published on 22 Jun 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, which triggered remote code execution through NFS schedule backup. An attacker logged into the management console could use this flaw to execute arbitrary shell commands on the CloudForms server as root.
Which versions are affected by CVE-2019-14894?
It affects 1 product.
Linux distribution packages (15)
cfme Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme-amazon-smartstate Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme-appliance Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme-appliance-common Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme-appliance-debuginfo Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme-appliance-tools Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme-debuginfo Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme-gemset Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme-gemset-debuginfo Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.15.1-1.el7cf |
cfme Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.3.1-1.el8cf |
cfme-amazon-smartstate Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.3.1-1.el8cf |
cfme-appliance Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.3.1-1.el8cf |
cfme-appliance-common Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.3.1-1.el8cf |
cfme-appliance-tools Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.3.1-1.el8cf |
cfme-gemset Red Hat:cloudforms_managementengine:5.11::el8 | All versions | 0:5.11.3.1-1.el8cf |
Products include Redhat Cloudforms Management Engine.
How do I fix CVE-2019-14894?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2019-14894 being exploited?
There is no known exploitation of CVE-2019-14894 in the wild and no public exploit code.
Other vulnerabilities in [UNKNOWN] CloudForms
Sources
Also known as GHSA-ghxf-76c7-3c47, RHSA-2020:0588, RHSA-2020:0589.