PT-2020-3569 · Red Hat · Cloudforms

Purnachand Pulahari + 1 · Published 2020-08-03 · Updated 2021-07-21 · CVE-2020-10779

Positive Technologies (AI Summary)

CVSS v2.0

8.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Red Hat CloudForms versions 4.7 through 5

Description The issue is related to insufficient access control in the CloudForms Management Engine, allowing for insecure direct object references (IDOR) and functional level access control bypass due to a missing privilege check. This could enable an attacker, who knows the right criteria, to access sensitive data within CloudForms.

Recommendations For Red Hat CloudForms versions 4.7 through 5, consider restricting access to sensitive data until a patch is available. As a temporary workaround, consider implementing additional access control checks to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

IDOR

Weakness Enumeration

CWE-284

CWE-639

Related Identifiers

BDU:2020-03902

CVE-2020-10779

RHSA-2020:3358

Affected Products

Cloudforms

References · 6

• https://osv.dev/vulnerability/CVE-2020-10779 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03902 · Security Note
• https://access.redhat.com/security/cve/cve-2020-10779 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10779 · Security Note
• https://t.me/cibsecurity/14025 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=1847647 · Note