CVE-2020-14369

CWE-352 — Cross-Site Request Forgery (CSRF)4 documents4 sources
Severity
6.3MEDIUM
EPSS
0.1%
top 69.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Cloudforms
Timeline
PublishedDec 2

Description

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:LExploitability: 2.8 | Impact: 3.4

Affected Packages2 packages

▶CVEListV5cloudformscfme-gemset 5.11.8.1-1

🔴Vulnerability Details

1
CVEList
CVE-2020-14369: This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a↗2020-12-02
▶

📋Vendor Advisories

1
Red Hat
CloudForms: Cross Site Request Forgery in API notifications↗2020-08-24
▶

💬Community

1
Bugzilla
CVE-2020-14369 CloudForms: Cross Site Request Forgery in API notifications↗2020-08-24
▶
CVE-2020-14369 (MEDIUM CVSS 6.3) | This release fixes a Cross Site Req | cvebase.io