{"api_version":"1","generated_at":"2026-07-23T14:50:54+00:00","cve":"CVE-2013-2050","urls":{"html":"https://cve.report/CVE-2013-2050","api":"https://cve.report/api/cve/CVE-2013-2050.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2013-2050","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2013-2050"},"summary":{"title":"CVE-2013-2050","description":"SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.","state":"PUBLISHED","assigner":"redhat","published_at":"2014-01-11 01:55:02","updated_at":"2026-04-29 01:13:23"},"problem_types":["CWE-89","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"7.5","severity":"","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=959062","name":"https://bugzilla.redhat.com/show_bug.cgi?id=959062","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"959062 – (CVE-2013-2050) CVE-2013-2050 CloudForms Management Engine 2: miq_policy/explorer SQL injection","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://packetstormsecurity.com/files/124609/cfme_manageiq_evm_pass_reset.rb.txt","name":"http://packetstormsecurity.com/files/124609/cfme_manageiq_evm_pass_reset.rb.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Red Hat CloudForms Management Engine 5.1 miq_policy/explorer SQL Injection ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89984","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89984","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/56181","name":"http://secunia.com/advisories/56181","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Security Advisory SA56181 - Red Hat CloudForms "profile[]" miq_policy/explorer SQL Injection Vulnerability - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/64524","name":"http://www.securityfocus.com/bid/64524","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Red Hat CloudForms Management Engine 'MiqPolicyController' Component SQL Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHEA-2013:1487","name":"MISC:https://access.redhat.com/errata/RHEA-2013:1487","refsource":"MITRE","tags":[],"title":"Red Hat Customer Portal - Access to 24x7 support and knowledge","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://access.redhat.com/security/cve/CVE-2013-2050","name":"MISC:https://access.redhat.com/security/cve/CVE-2013-2050","refsource":"MITRE","tags":[],"title":"CVE-2013-2050 - Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2050","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2050","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2013","cve_id":"2050","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms_management_engine","cpe6":"5.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2013","cve_id":"2050","vulnerable":"1","versionEndIncluding":"5.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"manageiq_enterprise_virtualization_manager","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2013","cve_id":"2050","cve":"CVE-2013-2050","epss":"0.541610000","percentile":"0.980300000","score_date":"2026-05-01","updated_at":"2026-05-02 00:02:52"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T15:20:37.414Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.com/files/124609/cfme_manageiq_evm_pass_reset.rb.txt"},{"name":"56181","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/56181"},{"name":"64524","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/64524"},{"name":"cloudforms-cve20132050-sql-injection(89984)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89984"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=959062"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2013-11-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-08-28T12:57:01.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.com/files/124609/cfme_manageiq_evm_pass_reset.rb.txt"},{"name":"56181","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/56181"},{"name":"64524","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/64524"},{"name":"cloudforms-cve20132050-sql-injection(89984)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/89984"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.redhat.com/show_bug.cgi?id=959062"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2013-2050","datePublished":"2014-01-11T01:00:00.000Z","dateReserved":"2013-02-19T00:00:00.000Z","dateUpdated":"2024-08-06T15:20:37.414Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-01-11 01:55:02","lastModifiedDate":"2026-04-29 01:13:23","problem_types":["CWE-89","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:P/A:P","baseScore":7.5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"HIGH","exploitabilityScore":10,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:cloudforms_management_engine:5.1:*:*:*:*:*:*:*","matchCriteriaId":"2B33708F-3EBC-4D66-A0E1-E55816B2E067"},{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:manageiq_enterprise_virtualization_manager:*:*:*:*:*:*:*:*","versionEndIncluding":"5.0","matchCriteriaId":"0F3BD343-91FA-4999-B882-4087BD6B353D"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2013","CveId":"2050","Ordinal":"1","Title":"CVE-2013-2050","CVE":"CVE-2013-2050","Year":"2013"},"notes":[{"CveYear":"2013","CveId":"2050","Ordinal":"1","NoteData":"SQL injection vulnerability in the miq_policy controller in Red Hat CloudForms 2.0 Management Engine (CFME) 5.1 and ManageIQ Enterprise Virtualization Manager 5.0 and earlier allows remote authenticated users to execute arbitrary SQL commands via the profile[] parameter in an explorer action.","Type":"Description","Title":"CVE-2013-2050"},{"CveYear":"2013","CveId":"2050","Ordinal":"2","NoteData":"2014-01-10","Type":"Other","Title":"Published"},{"CveYear":"2013","CveId":"2050","Ordinal":"3","NoteData":"2017-08-28","Type":"Other","Title":"Modified"}]}}}