CVE-2020-14325
Fixed in a distro release EPSS 1%
Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator.
Products: redhat cloudforms
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat cloudforms managementengine 5.10 | cfme | 0:5.10.16.0-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-appliance | 0:5.10.16.0-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-appliance-common | 0:5.10.16.0-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-appliance-debuginfo | 0:5.10.16.0-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-appliance-tools | 0:5.10.16.0-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-debuginfo | 0:5.10.16.0-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-gemset | 0:5.10.16.0-1.el7cf |
| Red Hat cloudforms managementengine 5.10 | cfme-gemset-debuginfo | 0:5.10.16.0-1.el7cf |
| Red Hat cloudforms managementengine 5.11 | cfme | 0:5.11.7.3-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-gemset | 0:5.11.7.3-1.el8cf |