What is CVE-2020-14369?

CVE-2020-14369 is a medium-severity vulnerability in Red Hat Cloudforms, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.3/10. Published 2020-12-02.

How severe is CVE-2020-14369?

Medium severity. CVSS v3 base score is 6.3 out of 10.

CSRF in Red Hat Cloudforms

CVE-2020-14369

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.003 (26.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L.

Affected products

Redhat Cloudforms
N/a Cloudforms — versions cfme-gemset 5.11.8.1-1

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

secalert@redhat.com (x_refsource_MISC, Issue Tracking, Vendor Advisory)

Frequently asked questions

What is CVE-2020-14369?: CVE-2020-14369 is a medium-severity vulnerability in Red Hat Cloudforms, classified under Cross-Site Request Forgery (CSRF). CVSS score: 6.3/10. Published 2020-12-02.
How severe is CVE-2020-14369?: Medium severity. CVSS v3 base score is 6.3 out of 10.