CVE-2020-10778 Business logic in CloudForms
Attackers can modify read-only fields in Red Hat CloudForms by removing client-side disabled attributes due to missing server-side validation.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10778?
CVE-2020-10778 is a medium-severity vulnerability in CloudForms, published on 11 Aug 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.
Weakness: CWE-669
Which versions are affected by CVE-2020-10778?
It affects 1 product.
Products include Redhat Cloudforms.
How do I fix CVE-2020-10778?
Apply the vendor's patch.
Is CVE-2020-10778 being exploited?
There is no known exploitation of CVE-2020-10778 in the wild and no public exploit code.