by Kastro
Paper/Archive/CVE-2020-14324

CVE-2020-14324

redhat — A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0.

EPSS 3%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 84.8.848 × 2017.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.

Affected

ProductAffectedFixed inSource
CloudFormscfme 5.11.7.0–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=1855713refaccess.redhat.com/security/cve/cve-2020-14324