CVE-2020-10778: Medium severity redhat Cloudforms vulnerability
Published Jun 16, 2020
·Updated
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.
Affected Software
3 affected componentsFixes available
redhat/cfme-gemset<5.11.7.1
5.11.7.1
redhat Cloudforms=4.7
redhat Cloudforms=5.0.0
Event History
Aug 11, 2020
CVE Published
via MITRE·12:25 PM
Data Sourced
via MITRE·12:25 PM
DescriptionWeakness
Frequently Asked Questions
1
What is CVE-2020-10778?
CVE-2020-10778 is a vulnerability in Red Hat CloudForms 4.7 and 5 that allows read-only widgets to be edited by inspecting the forms and removing the disabled attribute.
2
What is the severity of CVE-2020-10778?
CVE-2020-10778 has a severity value of 6, indicating a high severity.
3
How does CVE-2020-10778 violate expected behavior?
CVE-2020-10778 violates expected behavior by allowing the editing of read-only widgets without server-side validation.
4
Which versions of Red Hat CloudForms are affected by CVE-2020-10778?
Red Hat CloudForms 4.7 and 5.0.0 are affected by CVE-2020-10778.
5
How can I fix CVE-2020-10778?
To fix CVE-2020-10778, update to Red Hat CloudForms 5.11.7.1.