Purnachand Pulahari

The issue is related to insufficient access control in the CloudForms Management Engine, allowing for insecure direct object references (IDOR) and functional level access control bypass due to a missing privilege check. This could enable an attacker, who knows the right criteria, to access sensitive data within CloudForms.

The issue is related to a Server-Side Request Forgery (SSRF) flaw. It allows an attacker, with access to add an Ansible Tower provider, to scan and attack systems from the internal network that are not normally accessible. The vulnerability is due to insufficient validation of incoming requests, which can be exploited by a remote attacker to scan the internal network.