Skip to content
Fencer Intel
high 7.4

CVE-2017-12191 json

A flaw was found in the CloudForms account configuration when using VMware.

published 2018-02-28 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-3766

cvss
7.4
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 59%
public exploits
0
none known

Summary

A flaw was found in the CloudForms account configuration when using VMware. By default, a shared account is used that has privileged access to VMRC (VMWare Remote Console) functions that may not be appropriate for users of CloudForms (and thus this account). An attacker could use this vulnerability to view and make changes to settings in the VMRC and virtual machines controlled by it that they should not have access to.

Patch / fix

  • cfme cloudforms managementengine 5.8 5.8.3.4-1.el7cf
  • ansible cloudforms managementengine 5.8 2.4.3.0-1.el7ae
  • cfme-gemset cloudforms managementengine 5.8 5.8.3.4-1.el7cf
  • postgresql94 cloudforms managementengine 5.8 9.4.15-3PGDG.el7at
  • python-crypto cloudforms managementengine 5.8 2.6.1-16.el7at
  • cfme-appliance cloudforms managementengine 5.8 5.8.3.4-1.el7cf
  • python2-crypto cloudforms managementengine 5.8 2.6.1-16.el7at
  • python-jmespath cloudforms managementengine 5.8 0.9.0-4.el7ae

red hat advisories RHSA-2018:0374

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-12191 updated cvss 7.4

CFME: VMRC plugin console grants users administrative access

  • Red Hat CloudForms Management Engine 5.8 cfme 5.8.3.4-1.el7cf, ansible 2.4.3.0-1.el7ae, cfme-gemset 5.8.3.4-1.el7cf, python-crypto 2.6.1-16.el7at, python-jmespath 0.9.0-4.el7ae, python-paramiko 2.1.1-2.el7ae, +13 more
    fixed: vendor fix RHSA-2018:0374

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.88% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Red Hat, Inc. CloudForms

Classification

Weakness
  • CWE-284 Improper Access Control
  • CWE-613 DEPRECATED: Insufficient Session Expiration

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.