Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2020-10778

In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.

Published

2020-08-11T13:15:12.040

Last Modified

2024-11-21T04:56:03.193

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 6.0 (MEDIUM)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

8.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    CWE-669
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application redhat cloudforms 4.7 Yes
Application redhat cloudforms 5.0.0 Yes
References