CVE-2014-3692

Related Files

Red Hat Security Advisory 2015-0028-01

Posted Jan 15, 2015

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2015-0028-01 - Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller framework for web application development. Action Pack implements the controller and the view components. It was found that CloudForms Management Engine exposed SQL filters via the REST API without any input escaping. An authenticated user could use this flaw to perform SQL injection attacks against the CloudForms Management Engine database.

tags | advisory, web, sql injection, ruby

systems | linux, redhat

advisories | CVE-2014-3692, CVE-2014-7814

SHA-256 | 8a56d3fa80b7922b97a12c02b14567a25741582063179eb604ec9b68d183c0f7

Download | Favorite | View