Description
Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms.
References (2)
Core 2
Core References
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=1847647
Vendor Advisory x_refsource_misc
https://access.redhat.com/security/cve/cve-2020-10779
Scores
CVSS v3
6.5
EPSS
0.0018
EPSS Percentile
39.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Details
CWE
CWE-639
Status
published
Products (2)
redhat/cloudforms
4.7
redhat/cloudforms
5.0.0
Published
Aug 11, 2020
Tracked Since
Feb 18, 2026