The customization template in Red Hat CloudForms 3.1 Management Engine (CFME) 5.3 uses a default password for the root account when a password is not specified for a new image, which allows remote attackers to gain privileges.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Cloudforms_3.1_management_engine | Redhat | 5.3 (including) | 5.3 (including) |
| CloudForms Management Engine 5.3 | RedHat | cfme-0:5.3.2.6-1.el6cf | * |
| CloudForms Management Engine 5.3 | RedHat | ruby193-rubygem-fog-0:1.19.0-2.el6cf | * |
| CloudForms Management Engine 5.3 | RedHat | ruby193-rubygem-linux_admin-0:0.9.4-1.el6cf | * |