CVE-2020-14324 Command injection in CloudForms
Authenticated attackers can execute arbitrary OS commands on Red Hat CloudForms servers via the Infrastructure Migration Solution setup.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14324?
CVE-2020-14324 is a critical command injection vulnerability in CloudForms, published on 11 Aug 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.
Weakness: CWE-78
Which versions are affected by CVE-2020-14324?
It affects 1 product.
Products include Redhat Cloudforms Management Engine.
How do I fix CVE-2020-14324?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-14324 being exploited?
There is no known exploitation of CVE-2020-14324 in the wild and no public exploit code.