Vulnerability Details : CVE-2020-10778
In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.
Products affected by CVE-2020-10778
- cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*
- cpe:2.3:a:redhat:cloudforms:5.0.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2020-10778
0.06%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 26 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2020-10778
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.5
|
MEDIUM | AV:N/AC:L/Au:S/C:P/I:P/A:P |
8.0
|
6.4
|
NIST | |
|
6.0
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:L |
1.2
|
4.7
|
NIST |
CWE ids for CVE-2020-10778
-
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.Assigned by: nvd@nist.gov (Primary)
References for CVE-2020-10778
-
https://access.redhat.com/security/cve/cve-2020-10778
Red Hat Customer PortalVendor Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1847628
1847628 – (CVE-2020-10778) CVE-2020-10778 CloudForms: Business logic bypass through widgetsIssue Tracking;Vendor Advisory
Jump to