VulnerabilityModified
CVE-2020-10779
Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check.
MEDIUM 6.5EPSS 0.78%
Does this matter?
Lower severity and a low EPSS score (0.78%). Track it; it rarely justifies an emergency change on its own.
Description
Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-639
- Affected
- redhat/cloudforms
- Source
- secalert@redhat.com
References
- https://access.redhat.com/security/cve/cve-2020-10779Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1847647Issue Tracking
- https://access.redhat.com/security/cve/cve-2020-10779Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1847647Issue Tracking
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.