Back

HIGH

2: static secret_token.rb value

Published May 1, 2018

Description

Red Hat CloudForms 2 Management Engine (CFME) allows remote attackers to conduct session tampering attacks by leveraging use of a static secret_token.rb secret.

Affected products

Remediation

Red Hat statement

This issue is resolved in CloudForms 3.0. The maintenance support policy for CloudForms 2.0 only covers critical security issues, meaning this issue is out of scope. Users of CloudForms 2.0 are advised to upgrade to CloudForms 3.0 to address this issue.

Metrics

Weaknesses (1)

References (6)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner redhat
Published May 1, 2018
Updated Aug 6, 2024
Reserved Feb 19, 2013
NVD
Status Modified
Modified Jun 16, 2026
Red Hat
Severity Important
Public date Nov 13, 2013