VulnerabilityModified
CVE-2020-10778
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation.
MEDIUM 6.0EPSS 0.88%
Does this matter?
Lower severity and a low EPSS score (0.88%). Track it; it rarely justifies an emergency change on its own.
Description
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.
- CVSS 3.1
- 6.0 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L
- EPSS
- 0.88% probability · 57th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-669
- Affected
- redhat/cloudforms
- Source
- secalert@redhat.com
References
- https://access.redhat.com/security/cve/cve-2020-10778Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1847628Issue Tracking, Vendor Advisory
- https://access.redhat.com/security/cve/cve-2020-10778Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1847628Issue Tracking, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.