CVE-2017-7497

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published
Jul 27, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-75007.8It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changinCVE-2017-75017.8It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with abilitCVE-2017-75027.5Null pointer dereference vulnerability in NSS since 3.24.0 was found when server receives empty SSLv2 messages resulting into denial of servCVE-2017-75039.8It was found that the Red Hat JBoss EAP 7.0.5 implementation of javax.xml.transform.TransformerFactory is vulnerable to XXE. An attacker couCVE-2017-75049.8HTTPServerILServlet.java in JMS over HTTP Invocation Layer of the JbossMQ implementation, which is enabled by default in Red Hat Jboss AppliCVE-2017-75058.8Foreman since version 1.5 is vulnerable to an incorrect authorization check due to which users with user management permission who are assigCVE-2017-75068.8spice versions though 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacCVE-2017-75077.5GnuTLS version 3.5.12 and earlier is vulnerable to a NULL pointer dereference while decoding a status response TLS extension with valid contCVE-2017-75087.5OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.CVE-2017-75096.5An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreqCVE-2017-75108.8In ovirt-engine 4.1, if a host was provisioned with cloud-init, the root password could be revealed through the REST interface.CVE-2017-75115.5poppler since version 0.17.3 has been vulnerable to NULL pointer dereference in pdfunite triggered by specially crafted documents.