CVE-2020-14325

Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator.

Score

CVSS 3.1 9.1 Critical

Status

Modified - secalert@redhat.com

Published

2020-08-11

Last modified

2024-08-04

Weaknesses

CWE-285

Affected products

• Cloudforms (Redhat)

References

• https://access.redhat.com/security/cve/cve-2020-14325
• https://bugzilla.redhat.com/show_bug.cgi?id=1855739