CVE-2020-14325: Critical severity red hat cloudforms vulnerability
Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-superadministrator, an attacker can perform any API request as a super administrator.
Other sources
Red Hat CloudForms was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-superadministrator, an attacker can perform any API request as a super administrator.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Red Hat CloudForms vulnerability?
The vulnerability ID for this Red Hat CloudForms vulnerability is CVE-2020-14325.
What is the severity of CVE-2020-14325?
The severity of CVE-2020-14325 is critical with a CVSS score of 9.1.
What is the affected software for CVE-2020-14325?
The affected software for CVE-2020-14325 is Red Hat CloudForms version before 5.11.7.0.
How can an attacker exploit CVE-2020-14325?
An attacker can exploit CVE-2020-14325 by creating existent and non-existent role-based access control users with groups and roles, specifically using the group EvmGroup-super_administrator.
Where can I find more information about CVE-2020-14325?
You can find more information about CVE-2020-14325 on the Red Hat Security Advisory and Bugzilla pages.