VIR Vulnerability Intelligence Relay

CVE-2014-7814

medium
Published 2015-01-16 · Modified 2026-05-06
CVSS v3
—
CVSS v2
6.5
VIR risk
6.5

Description

SQL injection vulnerability in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 allows remote authenticated users to execute arbitrary SQL commands via a crafted REST API request to an SQL filter.

Predictions

Exploit likelihood
20%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — http://rhn.redhat.com/errata/RHSA-2015-0028.html

Application impact
VendorProductVersionsFixed
redhat redhatcloudforms_3.1_management_engine5.3

References

CWEs

CWE-89

Verify integrity in audit chain (admin only). AS-IS.