Cloudforms Cloud Engine CVEs and Security Vulnerabilities

CVE-2012-5509

aeolus-configserver: aeolus-configserver-setup /tmp file conductor credentials leak

aeolus-configserver-setup in the Aeolas Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for a temporary file in /tmp, which allows local users to read credentials by reading this file.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Cloudforms Cloudengine Redhat

Products

1 Cloudforms Cloud Engine

CVE-2012-6117

Configserver: Passwords from application blueprint stored plaintext in configserver.log

Aeolus Configuration Server, as used in Red Hat CloudForms Cloud Engine before 1.1.2, uses world-readable permissions for /var/log/aeolus-configserver/configserver.log, which allows local users to read plaintext passwords by reading the log file.