CVE-2014-3489

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:P/I:N/A:N

Weakness enumeration

CWE-255

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://rhn.redhat.com/errata/RHSA-2014-0816.htmlVendor Advisory
http://www.securityfocus.com/bid/68299
http://rhn.redhat.com/errata/RHSA-2014-0816.htmlVendor Advisory
http://www.securityfocus.com/bid/68299

Timeline

Published: Jul 7, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-34907.5RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable CVE-2014-34914.3Cross-site scripting (XSS) vulnerability in Foreman before 1.4.5 and 1.5.x before 1.5.1 allows remote attackers to inject arbitrary web scri CVE-2014-34924.3Multiple cross-site scripting (XSS) vulnerabilities in the host YAML view in Foreman before 1.4.5 and 1.5.x before 1.5.1 allow remote attack CVE-2014-34932.7The push_ascii function in smbd in Samba 3.6.x before 3.6.24, 4.0.x before 4.0.19, and 4.1.x before 4.1.9 allows remote authenticated users CVE-2014-34944.3kio/usernotificationhandler.cpp in the POP3 kioslave in kdelibs 4.10.95 before 4.13.3 does not properly generate warning notifications, whic CVE-2014-34957.5duplicity 0.6.24 has improper verification of SSL certificates CVE-2014-349610.0cartridge_repository.rb in OpenShift Origin and Enterprise 1.2.8 through 2.1.1 allows remote attackers to execute arbitrary commands via she CVE-2014-34974.3Cross-site scripting (XSS) vulnerability in OpenStack Swift 1.11.0 through 1.13.1 allows remote attackers to inject arbitrary web script or CVE-2014-34988.8The user module in ansible before 1.6.6 allows remote authenticated users to execute arbitrary commands.CVE-2014-34997.2Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via un CVE-2014-35006.4Apache Cordova Android before 3.5.1 allows remote attackers to change the start page via a crafted intent URL.CVE-2014-35014.3Apache Cordova Android before 3.5.1 allows remote attackers to bypass the HTTP whitelist and connect to arbitrary servers by using JavaScrip