CVE-2020-10780: Input Validation
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-10780?
CVE-2020-10780 is a vulnerability in Red Hat CloudForms 4.7 and 5 that allows for a CSV Injection attack.
How does CVE-2020-10780 work?
CVE-2020-10780 works by exploiting a flaw in Red Hat CloudForms that allows for a crafted payload to remain dormant until a victim exports a file as CSV and opens it with Excel.
What is the severity of CVE-2020-10780?
CVE-2020-10780 has a severity level of medium with a CVSS score of 6.3.
Is there a fix for CVE-2020-10780?
Yes, Red Hat has released a fix for CVE-2020-10780. Users are advised to update to version 5.11.7.0 of CloudForms Management Engine.
Where can I find more information about CVE-2020-10780?
You can find more information about CVE-2020-10780 on the Red Hat security advisory page: https://access.redhat.com/security/cve/cve-2020-10780