CVE-2017-2653

Related Files

Red Hat Security Advisory 2017-0898-01

Posted Apr 12, 2017

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2017-0898-01 - Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller framework for web application development. Action Pack implements the controller and the view components. Security Fix: A number of unused delete routes are present in CloudForms which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.

tags | advisory, web, xss, ruby

systems | linux, redhat

advisories | CVE-2017-2653

SHA-256 | 4fb7e840da60c5dd31a9dca1157ce3e5bb64bcb5760125959af531a7970d6266

Download | Favorite | View