VDB
CVE-2020-14369
CVE-2020-14369
PUBLISHED
Reported by redhat · Published December 2, 2020
This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | CloudForms | cfme-gemset 5.11.8.1-1 |
| n/a | CloudForms | 5.11.8.1-1 |
Timeline
- Dec 2, 2020 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- Aug 4, 2024 CVE Updated
- Sep 5, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2020-14369
vulnetix vdb fixes CVE-2020-14369Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-14369/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart