CVE-2020-10779 — MEDIUM (6.5)

Vulnerability Description

Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Redhat	Cloudforms	4.7

Related Weaknesses (CWE)

CWE-639

References

https://access.redhat.com/security/cve/cve-2020-10779Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1847647Issue Tracking
https://access.redhat.com/security/cve/cve-2020-10779Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1847647Issue Tracking

FAQ

What is CVE-2020-10779?

CVE-2020-10779 is a vulnerability with a CVSS score of 6.5 (MEDIUM). Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right crit...

How severe is CVE-2020-10779?

CVE-2020-10779 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-10779?

Check the references section above for vendor advisories and patch information. Affected products include: Redhat Cloudforms.