Bug 1871921 (CVE-2020-14369)

Summary:	CVE-2020-14369 CloudForms: Cross Site Request Forgery in API notifications
Product:	[Other] Security Response	Reporter:	Yadnyawalk Tale <ytale>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akarol, cbudzilo, dmetzger, gmccullo, gtanzill, jfrey, jhardy, obarenbo, roliveri, simaishi, smallamp
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	cfme-gemset 5.11.8.1-1	Doc Type:	If docs needed, set a value
Doc Text:	This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-09-30 20:21:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1871924
Bug Blocks:	1871878

Description Yadnyawalk Tale 2020-08-24 15:28:48 UTC

CloudForms version 5.11 and below are vulnerable to Cross Site Request Forgery attack which can force the user to perform state changing requests if the user is currently authenticated.

Comment 1 Yadnyawalk Tale 2020-08-24 15:28:55 UTC

Acknowledgments:

Name: Sruthi M (IBM), Purnachand Pulahari (IBM)
Upstream: ManageIQ

Comment 9 errata-xmlrpc 2020-09-30 13:55:21 UTC

This issue has been addressed in the following products:

  CloudForms Management Engine 5.11

Via RHSA-2020:4134 https://access.redhat.com/errata/RHSA-2020:4134

Comment 10 Product Security DevOps Team 2020-09-30 20:21:24 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-14369