CVE Feed

    Dashboard / CVE / CVE-2013-2050

    CVE-2013-2050

    SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.

    Published:Nov 13, 2013
    Last Modified:Apr 11, 2025
    EPS:Jan 11, 2014
    EPSS Score:0.53746
    CVSS Score:7.5

    Affected Products

    Vendor
    Redhat
    Product
    Cloudforms Management Engine
    Vendor
    Redhat
    Product
    Cloudforms Managementengine
    Vendor
    Redhat
    Product
    Manageiq Enterprise Virtualization Manager

    Exploits

    http://packetstormsecurity.com/files/124609/cfme_manageiq_evm_pass_reset.rb.txthttp://www.securityfocus.com/bid/64524http://packetstormsecurity.com/files/124609/cfme_manageiq_evm_pass_reset.rb.txthttp://www.securityfocus.com/bid/64524

    Related CVEs

    CVE-2020-14324 (CVSS 9.1) — A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out …
    CVE-2020-14296 (CVSS 7.1) — Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add…
    CVE-2020-10780 (CVSS 6.3) — Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim …
    CVE-2019-14894 (CVSS 8) — A flaw was found in the CloudForms management engine version 5.10 and CloudForms management version 5.11, whic…
    CVE-2020-1739 (CVSS 3.9) — A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior when a password is set with…
    CVE-2020-1740 (CVSS 3.9) — A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes …
    CVE-2020-1736 (CVSS 2.2) — A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be…
    CVE-2020-1738 (CVSS 3.9) — A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not s…
    CVE-2020-1733 (CVSS 5) — A race condition flaw was found in Ansible Engine 2.7.17 and prior, 2.8.9 and prior, 2.9.6 and prior when runn…
    CVE-2020-1735 (CVSS 4.2) — A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High