CVE-2020-14369

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.

Score
CVSS 3.1 6.3 Medium
Status
Modified - secalert@redhat.com
Published
2020-12-02
Last modified
2024-08-04
Weaknesses
CWE-352

Affected products

References

 
 
© AVABIS GmbH privacypolicy about