cnvd - cnvd-2020-44407

cnvd-2020-44407

Vulnerability from cnvd

Title: Red Hat CloudForms路径遍历漏洞

Description:

Red Hat CloudForms是美国红帽（Red Hat）公司的一套混合基础架构管理平台。该平台可跨越虚拟机、云、容器和物理基础架构，为用户提供部署、管理等功能。

Red Hat CloudForms中存在路径遍历漏洞，该漏洞源于网络系统或产品未能正确地过滤资源或文件路径中的特殊元素。攻击者可利用该漏洞绕过服务器端的验证。

Severity: 低

Formal description:

厂商尚未提供漏洞修复方案，请关注厂商主页更新： https://www.redhat.com/

Reference: https://access.redhat.com/security/cve/cve-2020-10778

Impacted products

Name
Red Hat CloudForms

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2020-10778",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2020-10778"
    }
  },
  "description": "Red Hat CloudForms\u662f\u7f8e\u56fd\u7ea2\u5e3d\uff08Red Hat\uff09\u516c\u53f8\u7684\u4e00\u5957\u6df7\u5408\u57fa\u7840\u67b6\u6784\u7ba1\u7406\u5e73\u53f0\u3002\u8be5\u5e73\u53f0\u53ef\u8de8\u8d8a\u865a\u62df\u673a\u3001\u4e91\u3001\u5bb9\u5668\u548c\u7269\u7406\u57fa\u7840\u67b6\u6784\uff0c\u4e3a\u7528\u6237\u63d0\u4f9b\u90e8\u7f72\u3001\u7ba1\u7406\u7b49\u529f\u80fd\u3002\n\nRed Hat CloudForms\u4e2d\u5b58\u5728\u8def\u5f84\u904d\u5386\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7f51\u7edc\u7cfb\u7edf\u6216\u4ea7\u54c1\u672a\u80fd\u6b63\u786e\u5730\u8fc7\u6ee4\u8d44\u6e90\u6216\u6587\u4ef6\u8def\u5f84\u4e2d\u7684\u7279\u6b8a\u5143\u7d20\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u7ed5\u8fc7\u670d\u52a1\u5668\u7aef\u7684\u9a8c\u8bc1\u3002",
  "formalWay": "\u5382\u5546\u5c1a\u672a\u63d0\u4f9b\u6f0f\u6d1e\u4fee\u590d\u65b9\u6848\uff0c\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\u66f4\u65b0\uff1a\r\nhttps://www.redhat.com/",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-44407",
  "openTime": "2020-08-05",
  "products": {
    "product": "Red Hat CloudForms"
  },
  "referenceLink": "https://access.redhat.com/security/cve/cve-2020-10778",
  "serverity": "\u4f4e",
  "submitTime": "2020-08-05",
  "title": "Red Hat CloudForms\u8def\u5f84\u904d\u5386\u6f0f\u6d1e"
}

CVE-2020-10778 (GCVE-0-2020-10778)

Vulnerability from cvelistv5

Published

2020-08-11 12:25

Modified

2024-08-04 11:14

Severity ?

CWE

Incorrect Authorization

Summary

In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1847628	x_refsource_MISC
	https://access.redhat.com/security/cve/cve-2020-10778	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	CloudForms	Version: 4.7 and 5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T11:14:15.585Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847628"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/cve-2020-10778"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "CloudForms",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "4.7 and 5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Incorrect Authorization",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-08-11T12:25:07",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847628"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://access.redhat.com/security/cve/cve-2020-10778"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-10778",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "CloudForms",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "4.7 and 5"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In Red Hat CloudForms 4.7 and 5, the read only widgets can be edited by inspecting the forms and dropping the disabled attribute from the fields since there is no server-side validation. This business logic flaw violate the expected behavior."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Incorrect Authorization"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1847628",
              "refsource": "MISC",
              "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847628"
            },
            {
              "name": "https://access.redhat.com/security/cve/cve-2020-10778",
              "refsource": "MISC",
              "url": "https://access.redhat.com/security/cve/cve-2020-10778"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-10778",
    "datePublished": "2020-08-11T12:25:07",
    "dateReserved": "2020-03-20T00:00:00",
    "dateUpdated": "2024-08-04T11:14:15.585Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted