CVE-2020-14325

published 2020-08-11

CVE-2020-14325: Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and…

critical 9.1 CVSS 3.1

AV N AC L PR N UI N S U C H I H A N

Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
redhat	cloudforms	< 5.11.7.0	5.11.7.0
redhat	cloudforms	—	—

CWE-285