Red Hat CloudForms 4.7 and 5 was vulnerable to Server-Side Request Forgery (SSRF) flaw. With the access to add Ansible Tower provider, an attacker could scan and attack systems from the internal network which are not normally accessible.
A flaw was found in CloudForms's v2v infrastructure mapping delete feature. A stored cross-site scripting in CloudForms 5.9.3.1 build due to improper sanitization of user input in Name field.