CVE-2016-7040

8.8 highEPSS 2.3%

High (8.8) in redhat cloudforms management engine. EPSS 2.3% chance of exploitation in the next 30 days.

Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, which allows remote authenticated users to execute arbitrary shell commands by leveraging the ability to view and filter collections.

Severity

CVSS 3.0

8.8 high

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 2.3% chance of exploitation in the next 30 days; higher than 82% of CVEs (scores of 2026-10-31)
CWE: CWE-284
Published: 2016-10-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

redhat:cloudforms_management_engine

References

http://rhn.redhat.com/errata/RHSA-2016-1996.html
http://www.securityfocus.com/bid/93893
http://rhn.redhat.com/errata/RHSA-2016-1996.html
http://www.securityfocus.com/bid/93893

Check your stack JSON