CVE-2014-3489 — MEDIUM (4.3)

Q: How severe is CVE-2014-3489?

CVE-2014-3489 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2014-3489?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Cloudforms 3.0 Management Engine.

Vulnerability Description

lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attack.

CVSS Score

4.3

MEDIUM

AV:N/AC:M/Au:N/C:P/I:N/A:N

Confidentiality

PARTIAL

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Cloudforms 3.0 Management Engine	<= 5.2.4

Related Weaknesses (CWE)

CWE-255

References

http://rhn.redhat.com/errata/RHSA-2014-0816.htmlVendor Advisory
http://www.securityfocus.com/bid/68299
http://rhn.redhat.com/errata/RHSA-2014-0816.htmlVendor Advisory
http://www.securityfocus.com/bid/68299

FAQ

What is CVE-2014-3489?

CVE-2014-3489 is a vulnerability with a CVSS score of 4.3 (MEDIUM). lib/util/miq-password.rb in Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 uses a hard-coded salt, which makes it easier for remote attackers to guess passwords via a brute force attac...

How severe is CVE-2014-3489?

CVE-2014-3489 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-3489?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Cloudforms 3.0 Management Engine.