Skip to content
Fencer Intel
medium 4.1

CVE-2017-7497 json

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user.

published 2018-07-27 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16514

cvss
4.1
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.0%
EPSS 1.0% chance of exploitation in 30 days, percentile 62%
public exploits
0
none known

Summary

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.

Patch / fix

  • cfme cloudforms managementengine 5.7 5.7.3.2-1.el7cf
  • cfme-gemset cloudforms managementengine 5.7 5.7.3.2-1.el7cf
  • cfme-appliance cloudforms managementengine 5.7 5.7.3.2-1.el7cf
  • rh-ruby23-rubygem-nokogiri cloudforms managementengine 5.8, cloudforms managementengine 5.7 1.7.2-1.el7cf
  • rh-ruby23-rubygem-ovirt-engine-sdk4 cloudforms managementengine 5.7 4.1.5-1.el7cf
  • cfme cloudforms managementengine 5.8 5.8.1.5-1.el7cf
  • ansible cloudforms managementengine 5.8 2.3.0.0-1.el7
  • cfme-gemset cloudforms managementengine 5.8 5.8.1.5-1.el7cf

red hat advisories RHSA-2017:1601RHSA-2017:1758

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2017-7497 updated cvss 4.1

CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497

  • Red Hat CloudForms Management Engine 5.7 cfme 5.7.3.2-1.el7cf, cfme-gemset 5.7.3.2-1.el7cf, cfme-appliance 5.7.3.2-1.el7cf, rh-ruby23-rubygem-nokogiri 1.7.2-1.el7cf, rh-ruby23-rubygem-ovirt-engine-sdk4 4.1.5-1.el7cf
    fixed: vendor fix RHSA-2017:1601
  • Red Hat CloudForms Management Engine 5.8 cfme 5.8.1.5-1.el7cf, ansible 2.3.0.0-1.el7, cfme-gemset 5.8.1.5-1.el7cf, cfme-appliance 5.8.1.5-1.el7cf, ansible-tower-setup 3.1.3-1.el7at, ansible-tower-server 3.1.3-1.el7at, +1 more
    fixed: vendor fix RHSA-2017:1758

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.99% chance of exploitation in the next 30 days, higher than 62% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.0 4.1 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
NVD 3.0 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N

Affected products

  • [UNKNOWN] CFME

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.