{"api_version":"1","generated_at":"2026-07-23T12:43:43+00:00","cve":"CVE-2014-0136","urls":{"html":"https://cve.report/CVE-2014-0136","api":"https://cve.report/api/cve/CVE-2014-0136.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-0136","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-0136"},"summary":{"title":"CVE-2014-0136","description":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.","state":"PUBLISHED","assigner":"redhat","published_at":"2014-10-27 01:55:24","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-20","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"5","severity":"","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2014-1037.html","name":"http://rhn.redhat.com/errata/RHSA-2014-1037.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/69233","name":"http://www.securityfocus.com/bid/69233","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Malformed Request","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://access.redhat.com/errata/RHSA-2014:1037","name":"MISC:https://access.redhat.com/errata/RHSA-2014:1037","refsource":"MITRE","tags":[],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/security/cve/CVE-2014-0136","name":"MISC:https://access.redhat.com/security/cve/CVE-2014-0136","refsource":"MITRE","tags":[],"title":"CVE-2014-0136 - Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076669","name":"MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1076669","refsource":"MITRE","tags":[],"title":"1076669 – (CVE-2014-0136) CVE-2014-0136 CFME: AgentController get/log application log forging","mime":"text/html","httpstatus":"200","archivestatus":"503"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0136","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0136","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"136","vulnerable":"1","versionEndIncluding":"5.2.5.3","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms_3.0_management_engine","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T09:05:39.026Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"RHSA-2014:1037","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1037.html"},{"name":"69233","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/69233"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-08-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2014-10-27T00:57:00.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","shortName":"redhat"},"references":[{"name":"RHSA-2014:1037","tags":["vendor-advisory","x_refsource_REDHAT"],"url":"http://rhn.redhat.com/errata/RHSA-2014-1037.html"},{"name":"69233","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/69233"}]}},"cveMetadata":{"assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","assignerShortName":"redhat","cveId":"CVE-2014-0136","datePublished":"2014-10-27T01:00:00.000Z","dateReserved":"2013-12-03T00:00:00.000Z","dateUpdated":"2024-08-06T09:05:39.026Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-10-27 01:55:24","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-20","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:N/I:P/A:N","baseScore":5,"accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:redhat:cloudforms_3.0_management_engine:*:*:*:*:*:*:*:*","versionEndIncluding":"5.2.5.3","matchCriteriaId":"0217FF0A-48CD-47C4-83EE-C59E427C1700"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"136","Ordinal":"1","Title":"CVE-2014-0136","CVE":"CVE-2014-0136","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"136","Ordinal":"1","NoteData":"The (1) get and (2) log methods in the AgentController in Red Hat CloudForms 3.0 Management Engine (CFME) 5.x allow remote attackers to insert arbitrary text into log files via unspecified vectors.","Type":"Description","Title":"CVE-2014-0136"},{"CveYear":"2014","CveId":"136","Ordinal":"2","NoteData":"2014-10-26","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"136","Ordinal":"3","NoteData":"2014-10-26","Type":"Other","Title":"Modified"}]}}}