CVE Feed

    Dashboard / CVE / CVE-2013-2049

    CVE-2013-2049

    Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.

    Published:Nov 13, 2013
    Last Modified:Nov 21, 2024
    EPS:May 1, 2018
    EPSS Score:0.00159
    CVSS Score:7.5

    Affected Products

    Vendor
    Redhat
    Product
    Cloudforms Management Engine
    Vendor
    Redhat
    Product
    Cloudforms Managementengine

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-384 Session Fixation

    Related CVEs

    CVE-2020-14324 (CVSS 9.1) — A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out …
    CVE-2020-14296 (CVSS 7.1) — Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add…
    CVE-2020-10780 (CVSS 6.3) — Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim …
    CVE-2019-14894 (CVSS 8) — A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, whic…
    CVE-2020-1739 (CVSS 3.9) — A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with…
    CVE-2020-1740 (CVSS 3.9) — A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes …
    CVE-2020-1736 (CVSS 2.2) — A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be…
    CVE-2020-1738 (CVSS 3.9) — A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not s…
    CVE-2020-1733 (CVSS 5) — A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when runn…
    CVE-2020-1735 (CVSS 4.2) — A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High