Vulnerability Report

CVE-2017-7549

Title: Openstack Instack-Undercloud

Other

Proof Of Concept

No public PoC currently indexed for CVE-2017-7549.

CWE Category CWE-59

Published Date Sep 21, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 6.4 CVSS v3.0

Exploit Probability (EPSS)

0.35%

Vulnerability Summary

CVE-2017-7549: A flaw was found in instack-undercloud 7.2.0 as packaged in Red Hat OpenStack Platform Pike, 6.1.0 as packaged in Red Hat OpenStack Platform Oacta, 5.3.0 as packaged in Red Hat OpenStack Newton, where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files.

Impacted Vendors

redhat 1

openstack 2

Reference Links

http://www.securityfocus.com/bid/100407 https://access.redhat.com/errata/RHSA-2017:2557 https://access.redhat.com/errata/RHSA-2017:2649 https://access.redhat.com/errata/RHSA-2017:2687 https://access.redhat.com/errata/RHSA-2017:2693 https://access.redhat.com/errata/RHSA-2017:2726 https://bugzilla.redhat.com/show_bug.cgi?id=1477403 http://www.securityfocus.com/bid/100407 https://access.redhat.com/errata/RHSA-2017:2557 https://access.redhat.com/errata/RHSA-2017:2649 https://access.redhat.com/errata/RHSA-2017:2687 https://access.redhat.com/errata/RHSA-2017:2693 https://access.redhat.com/errata/RHSA-2017:2726 https://bugzilla.redhat.com/show_bug.cgi?id=1477403

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

6.4

Attack Vector

LOCAL

Complexity

HIGH

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

CHANGED

RAW VECTOR CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

CVSS v2.0

Source Entity [email protected]

Severity LOW

3.3

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:M/Au:N/C:P/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns