CVE-2020-14369 Cross-site request forgery in CloudForms

Medium 6.3 Published 2 Dec 2020 Updated 4 Aug 2024

Attackers can force authenticated users to perform state-changing actions like provisioning VMs via crafted requests in Red Hat CloudForms.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2020-14369?

CVE-2020-14369 is a medium-severity vulnerability in CloudForms, published on 2 Dec 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.

Weakness: CWE-352

Which versions are affected by CVE-2020-14369?

It affects 1 product.

Linux distribution packages (1)

cfme-gemset Red Hat:cloudforms_managementengine:5.11::el8 All versions 0:5.11.8.1-1.el8cf

Products include Redhat Cloudforms.

How do I fix CVE-2020-14369?

Apply the vendor's patch.

Is CVE-2020-14369 being exploited?

There is no known exploitation of CVE-2020-14369 in the wild and no public exploit code.

Sources

Also known as RHSA-2020:4134.