Skip to content
Fencer Intel
medium 4.1

CVE-2017-2653 json

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST reque…

published 2018-07-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-11802

cvss
4.1
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute.

Patch / fix

  • redhat cloudforms_management_engine 5.7.2.1
  • cfme-gemset cloudforms managementengine 5.7 5.7.2.1-1.el7cf
  • cfme cloudforms managementengine 5.7 5.7.2.1-1.el7cf
  • cfme-appliance cloudforms managementengine 5.7 5.7.2.1-1.el7cf

red hat advisories RHSA-2017:0898

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-2653 updated cvss 4.1

CloudForms: UI security issue on Openstack actions

  • Red Hat CloudForms Management Engine 5.7 cfme 5.7.2.1-1.el7cf, cfme-gemset 5.7.2.1-1.el7cf, cfme-appliance 5.7.2.1-1.el7cf
    fixed: vendor fix RHSA-2017:0898

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.39% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 4.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

  • Red Hat CloudForms

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.