CVE-2014-0136
CVSS V2 Medium 5
CVSS V3 None
Description
The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.
Overview
- CVE ID
- CVE-2014-0136
- Assigner
- secalert@redhat.com
- Vulnerability Status
- Modified
- Published Version
- 2014-10-27T01:55:24
- Last Modified Date
- 2023-02-13T00:32:41
Weakness Enumerations
CPE Configuration (Product)
| CPE | Vulnerable | Operator | Version Start | Version End |
|---|---|---|---|---|
| cpe:2.3:a:redhat:cloudforms_3.0_management_engine:*:*:*:*:*:*:*:* | 1 | OR | 5.2.5.3 |
CVSS Version 2
- Version
- 2.0
- Vector String
- AV:N/AC:L/Au:N/C:N/I:P/A:N
- Access Vector
- NETWORK
- Access Compatibility
- LOW
- Authentication
- NONE
- Confidentiality Impact
- NONE
- Integrity Impact
- PARTIAL
- Availability Impact
- NONE
- Base Score
- 5
- Severity
- MEDIUM
- Exploitability Score
- 10
- Impact Score
- 2.9
References
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2014-0136 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0136 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2022-05-10 10:24:30 | Added to TrackCVE | |||
| 2022-12-02 02:04:38 | 2014-10-27T01:55Z | 2014-10-27T01:55:24 | CVE Published Date | updated |
| 2022-12-02 02:04:38 | 2015-01-28T00:31:54 | CVE Modified Date | updated | |
| 2022-12-02 02:04:38 | Analyzed | Vulnerability Status | updated | |
| 2023-02-02 21:04:32 | 2023-02-02T20:16:24 | CVE Modified Date | updated | |
| 2023-02-02 21:04:32 | Analyzed | Modified | Vulnerability Status | updated |
| 2023-02-02 21:04:32 | The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors. | It was found that the get and log methods of the AgentController wrote log messages without sanitizing user input. A remote attacker could use this flaw to insert arbitrary content into the log files written to by AgentController. | Description | updated |
| 2023-02-02 21:04:38 | References | updated | ||
| 2023-02-13 01:05:19 | 2023-02-13T00:32:41 | CVE Modified Date | updated | |
| 2023-02-13 01:05:19 | It was found that the get and log methods of the AgentController wrote log messages without sanitizing user input. A remote attacker could use this flaw to insert arbitrary content into the log files written to by AgentController. | The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors. | Description | updated |