CVE-2020-10780
First published: Wed Jun 17 2020(Updated: )
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/cfme | <5.11.7.0 | 5.11.7.0 |
| Redhat Cloudforms Management Engine | =4.7 | |
| Redhat Cloudforms Management Engine | =5.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2020-10780?
CVE-2020-10780 is a vulnerability in Red Hat CloudForms 4.7 and 5 that allows for a CSV Injection attack.
How does CVE-2020-10780 work?
CVE-2020-10780 works by exploiting a flaw in Red Hat CloudForms that allows for a crafted payload to remain dormant until a victim exports a file as CSV and opens it with Excel.
What is the severity of CVE-2020-10780?
CVE-2020-10780 has a severity level of medium with a CVSS score of 6.3.
Is there a fix for CVE-2020-10780?
Yes, Red Hat has released a fix for CVE-2020-10780. Users are advised to update to version 5.11.7.0 of CloudForms Management Engine.
Where can I find more information about CVE-2020-10780?
You can find more information about CVE-2020-10780 on the Red Hat security advisory page: https://access.redhat.com/security/cve/cve-2020-10780
- agent/author
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/type
- agent/weakness
- collector/nvd-index
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2020-10780
- agent/software-canonical-lookup
- vendor/redhat
- canonical/redhat cloudforms management engine
- version/redhat cloudforms management engine/4.7
- version/redhat cloudforms management engine/5.0
- package-manager/redhat