NVD

Id
31673  
Name
CVE-2014-3486  
Description
The (1) shell_exec function in lib/util/MiqSshUtilV1.rb and (2) temp_cmd_file function in lib/util/MiqSshUtilV2.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 allow local users to execute arbitrary commands via a symlink attack on a temporary file with a predictable name.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-07-07  
Modified Date
2017-01-06  
Seq
2014-3486  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
166028 31673 CVE-2014-3486 RHSA-2014:0816  View
166029 31673 CVE-2014-3486 68300  View
166030 31673 CVE-2014-3486 https://bugzilla.redhat.com/show_bug.cgi?id=1107528  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
14375 JVNDB-2014-003250 Red Hat CloudForms Management Engine における任意のコマンドを実行される脆弱性 Red Hat CloudForms Management Engine (CFME) の (1) lib/util/MiqSshUtilV1.rb の shell_exec 関数および (2) lib/util/MiqSshUtilV2.rb の temp_cmd_file 関数には、任意のコマンドを実行される脆弱性が存在します。 CVE-2014-3486 70774 CVE-2014-3486 31673 6.9 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-003250.html 2014-06-30 2014-07-09 View