CVE-2020-14325

Name of the Vulnerable Software and Affected Versions Red Hat CloudForms versions prior to 5.11.7.0

Description The issue is related to an authorization flaw that allows a malicious attacker to create existing and non-existing role-based access control users, with groups and roles. This can enable an attacker to perform any API request as a super administrator by selecting a specific group, such as EvmGroup-super administrator. The flaw is associated with errors in authorization.

Recommendations For versions prior to 5.11.7.0, update to version 5.11.7.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the EvmGroup-super administrator group to minimize the risk of exploitation. Additionally, restrict API requests to only necessary users and groups to reduce the potential impact of the flaw.