CVE-2016-7047

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

A flaw was found in the CloudForms API before 5.6.3.0, 5.7.3.1 and 5.8.1.2. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Red Hat	cfme	5.8.1.2; 5.7.3.1; 5.6.3.0

References

http://www.securityfocus.com/bid/99329Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1601Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1758Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7047Issue Tracking, Vendor Advisory
http://www.securityfocus.com/bid/99329Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2017:1601Vendor Advisory
https://access.redhat.com/errata/RHSA-2017:1758Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-7047Issue Tracking, Vendor Advisory

Timeline

Published: Sep 11, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-70488.1The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute a CVE-2016-70509.8SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server CVE-2016-70518.6XmlMapper in the Jackson XML dataformat component (aka jackson-dataformat-xml) before 2.7.8 and 2.8.x before 2.8.4 allows remote attackers t CVE-2016-70527.5crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application cras CVE-2016-70537.5In OpenSSL 1.1.0 before 1.1.0c, applications parsing invalid CMS structures can crash with a NULL pointer dereference. This is caused by a b CVE-2016-70547.5In OpenSSL 1.1.0 before 1.1.0c, TLS connections using *-CHACHA20-POLY1305 ciphersuites are susceptible to a DoS attack by corrupting larger CVE-2016-70555.9There is a carry propagating bug in the Broadwell-specific Montgomery multiplication procedure in OpenSSL 1.0.2 and 1.1.0 before 1.1.0c that CVE-2016-70565.5A timing attack flaw was found in OpenSSL 1.0.1u and before that could allow a malicious user with local access to recover ECDSA P-256 priva CVE-2016-70604.6The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate attacker CVE-2016-70616.5An information disclosure vulnerability was found in JBoss Enterprise Application Platform before 7.0.4. It was discovered that when configu CVE-2016-70627.8rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as clear CVE-2016-70639.8A flaw was found in pritunl-client before version 1.0.1116.6. Arbitrary write to user specified path may lead to privilege escalation.