CVE-2020-14369

Name of the Vulnerable Software and Affected Versions Red Hat CloudForms (affected versions not specified)

Description A Cross Site Request Forgery vulnerability was found in Red Hat CloudForms, which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting a custom flash file, which can force the user to perform state-changing requests like provisioning VMs, running ansible playbooks, and so forth. The vulnerability is related to the lack of protection against cross-site request forgery (CSRF).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.