Red Hat CloudForms up to 5.11.6.x Role-Based Access Control API Request authorization

Summaryinfo

A vulnerability has been found in Red Hat CloudForms up to 5.11.6.x and classified as critical. This affects an unknown part of the component Role-Based Access Control. The manipulation as part of API Request leads to authorization. This vulnerability is documented as CVE-2020-14325. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Red Hat CloudForms up to 5.11.6.x (Cloud Software). This issue affects an unknown part of the component Role-Based Access Control. The manipulation as part of a API Request leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-863. The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator.

The weakness was released 08/11/2020 as Bug 1855739 as not defined bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2020-14325 since 06/17/2020. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 5.11.7.0 eliminates this vulnerability.

Entries connected to this vulnerability are available at VDB-159490, VDB-159488 and VDB-159487. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Cloud Software

Vendor

• Red Hat

Name

• CloudForms

Version

• 5.11.0
• 5.11.1
• 5.11.2
• 5.11.3
• 5.11.4
• 5.11.5
• 5.11.6

License

• open-source

Website

• Vendor: https://www.redhat.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion