{"api_version":"1","generated_at":"2026-07-23T11:32:44+00:00","cve":"CVE-2017-15123","urls":{"html":"https://cve.report/CVE-2017-15123","api":"https://cve.report/api/cve/CVE-2017-15123.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-15123","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-15123"},"summary":{"title":"CVE-2017-15123","description":"A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2019-06-12 14:29:00","updated_at":"2019-07-17 14:15:00"},"problem_types":["CWE-306"],"metrics":[],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123","refsource":"CONFIRM","tags":["Issue Tracking","Vendor Advisory"],"title":"1524720 – (CVE-2017-15123) CVE-2017-15123 CloudForms: RSS links are accessible without any authentication","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/108690","name":"108690","refsource":"BID","tags":[],"title":"Red Hat CloudForms CVE-2017-15123 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://hacked0x90.wordpress.com/2019/07/17/cve-2017-15123-exploit/","name":"https://hacked0x90.wordpress.com/2019/07/17/cve-2017-15123-exploit/","refsource":"MISC","tags":[],"title":"CVE-2017-15123 Exploit – HacKeD","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15123","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15123","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"15123","vulnerable":"1","versionEndIncluding":"5.10","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms_management_engine","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2017-15123","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-306","cweId":"CWE-306"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"redhat","product":{"product_data":[{"product_name":"CloudForms","version":{"version_data":[{"version_affected":"=","version_value":"5.8 - 5.10"}]}}]}}]}},"references":{"reference_data":[{"url":"http://www.securityfocus.com/bid/108690","refsource":"MISC","name":"http://www.securityfocus.com/bid/108690"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123","refsource":"MISC","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15123"},{"url":"https://hacked0x90.wordpress.com/2019/07/17/cve-2017-15123-exploit/","refsource":"MISC","name":"https://hacked0x90.wordpress.com/2019/07/17/cve-2017-15123-exploit/"}]},"impact":{"cvss":[{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","version":"3.0"}]}},"nvd":{"publishedDate":"2019-06-12 14:29:00","lastModifiedDate":"2019-07-17 14:15:00","problem_types":["CWE-306"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"LOW","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":3.9,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:N/C:P/I:N/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE","baseScore":5},"severity":"MEDIUM","exploitabilityScore":10,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:cloudforms_management_engine:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndIncluding":"5.10","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"15123","Ordinal":"112625","Title":"CVE-2017-15123","CVE":"CVE-2017-15123","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"15123","Ordinal":"1","NoteData":"A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An attacker could use this flaw to view potentially sensitive information from CloudForms including data such as newly created virtual machines.","Type":"Description","Title":null},{"CveYear":"2017","CveId":"15123","Ordinal":"2","NoteData":"2019-06-12","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"15123","Ordinal":"3","NoteData":"2019-07-17","Type":"Other","Title":"Modified"}]}}}