CVE-2020-10779 Missing authorization in CloudForms
Attackers can bypass access controls to read sensitive data in Red Hat CloudForms due to missing privilege checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10779?
CVE-2020-10779 is a medium-severity missing authorization vulnerability in CloudForms, published on 11 Aug 2020. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms.
Weakness: CWE-639
Which versions are affected by CVE-2020-10779?
It affects 1 product.
Products include Redhat Cloudforms.
How do I fix CVE-2020-10779?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-10779 being exploited?
There is no known exploitation of CVE-2020-10779 in the wild and no public exploit code.