CVE-2014-3486

Published: Jul 7, 2014Modified: May 6, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.

Affected (7)

Products: Redhat: Cloudforms 3.0 Management Engine

Redhat

1 product

Cloudforms 3.0 Management Engine

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Cloudforms 3.0 Management Engine	Up to 5.2.4
Redhat Cloudforms 3.0 Management Engine	Version 5.2.1.6
Redhat Cloudforms 3.0 Management Engine	Version 5.2.1
Redhat Cloudforms 3.0 Management Engine	Version 5.2.2
Redhat Cloudforms 3.0 Management Engine	Version 5.2.3.2
Redhat Cloudforms 3.0 Management Engine	Version 5.2.3
Redhat Cloudforms 3.0 Management Engine	Version 5.2