CVE-2020-25716
Fixed in a distro release EPSS <1%
A flaw was found in Cloudforms. A role-based privileges escalation flaw where export or import of administrator files is possible. An attacker with a specific group can perform actions restricted only to system administrator. This is the affect of an incomplete fix for CVE-2020-10783. The highest threat from this vulnerability is to data confidentiality and integrity. Versions before cfme 5.11.10.1 are affected
Products: redhat cloudforms
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat cloudforms managementengine 5.11 | cfme | 0:5.11.10.1-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-amazon-smartstate | 0:5.11.10.1-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-appliance | 0:5.11.10.1-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-appliance-common | 0:5.11.10.1-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-appliance-tools | 0:5.11.10.1-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | cfme-gemset | 0:5.11.10.1-1.el8cf |
| Red Hat cloudforms managementengine 5.11 | v2v-conversion-host | 0:1.16.2-6.el8ev |
| Red Hat cloudforms managementengine 5.11 | v2v-conversion-host-ansible | 0:1.16.2-6.el8ev |