{"api_version":"1","generated_at":"2026-07-24T00:31:24+00:00","cve":"CVE-2017-7497","urls":{"html":"https://cve.report/CVE-2017-7497","api":"https://cve.report/api/cve/CVE-2017-7497.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2017-7497","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2017-7497"},"summary":{"title":"CVE-2017-7497","description":"The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.","state":"PUBLIC","assigner":"secalert@redhat.com","published_at":"2018-07-27 15:29:00","updated_at":"2023-02-12 23:30:00"},"problem_types":["CWE-284"],"metrics":[],"references":[{"url":"https://access.redhat.com/security/cve/CVE-2017-7497","name":"https://access.redhat.com/security/cve/CVE-2017-7497","refsource":"MISC","tags":[],"title":"CVE-2017-7497 - Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1450150","name":"https://bugzilla.redhat.com/show_bug.cgi?id=1450150","refsource":"MISC","tags":[],"title":"Bug 1450150 – CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2017:1601","name":"RHSA-2017:1601","refsource":"REDHAT","tags":["Vendor Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7497","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7497","refsource":"CONFIRM","tags":["Issue Tracking","Patch","Vendor Advisory"],"title":"1450150 – (CVE-2017-7497) CFME: Dialog for creating cloud volumes does not filter cloud tenants CVE-2017-7497","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://access.redhat.com/errata/RHSA-2017:1758","name":"RHSA-2017:1758","refsource":"REDHAT","tags":["Vendor Advisory"],"title":"Red Hat Customer Portal","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7497","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7497","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2017","cve_id":"7497","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms_management_engine","cpe6":"5.7.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"7497","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms_management_engine","cpe6":"5.8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"7497","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms_management_engine","cpe6":"5.7.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2017","cve_id":"7497","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"redhat","cpe5":"cloudforms_management_engine","cpe6":"5.8.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_version":"4.0","data_type":"CVE","data_format":"MITRE","CVE_data_meta":{"ID":"CVE-2017-7497","ASSIGNER":"secalert@redhat.com","STATE":"PUBLIC"},"description":{"description_data":[{"lang":"eng","value":"The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"CWE-284","cweId":"CWE-284"}]}]},"affects":{"vendor":{"vendor_data":[{"vendor_name":"[UNKNOWN]","product":{"product_data":[{"product_name":"CFME","version":{"version_data":[{"version_affected":"=","version_value":"n/a"}]}}]}}]}},"references":{"reference_data":[{"url":"https://access.redhat.com/errata/RHSA-2017:1601","refsource":"MISC","name":"https://access.redhat.com/errata/RHSA-2017:1601"},{"url":"https://access.redhat.com/errata/RHSA-2017:1758","refsource":"MISC","name":"https://access.redhat.com/errata/RHSA-2017:1758"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7497","refsource":"MISC","name":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7497"}]},"impact":{"cvss":[{"attackComplexity":"HIGH","attackVector":"NETWORK","availabilityImpact":"LOW","baseScore":4.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","version":"3.0"}]}},"nvd":{"publishedDate":"2018-07-27 15:29:00","lastModifiedDate":"2023-02-12 23:30:00","problem_types":["CWE-284"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"LOW","availabilityImpact":"NONE","baseScore":4.3,"baseSeverity":"MEDIUM"},"exploitabilityScore":2.8,"impactScore":1.4},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:N","accessVector":"NETWORK","accessComplexity":"LOW","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE","baseScore":4},"severity":"MEDIUM","exploitabilityScore":8,"impactScore":2.9,"acInsufInfo":true,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:cloudforms_management_engine:5.7.2:*:*:*:*:*:*:*","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:redhat:cloudforms_management_engine:5.8.0:*:*:*:*:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2017","CveId":"7497","Ordinal":"104302","Title":"CVE-2017-7497","CVE":"CVE-2017-7497","Year":"2017"},"notes":[{"CveYear":"2017","CveId":"7497","Ordinal":"1","NoteData":"The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant.","Type":"Description","Title":null},{"CveYear":"2017","CveId":"7497","Ordinal":"2","NoteData":"2018-07-27","Type":"Other","Title":"Published"},{"CveYear":"2017","CveId":"7497","Ordinal":"3","NoteData":"2018-07-28","Type":"Other","Title":"Modified"}]}}}