Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.
Acknowledgments: Name: Purnachand Pulahari (IBM), Ranjit Kumar Singh (IBM)
This issue has been addressed in the following products: CloudForms Management Engine 5.11 Via RHSA-2020:3358 https://access.redhat.com/errata/RHSA-2020:3358
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-10780
Red Hat CVSS explanation: PR:L => To download CSV from CloudForms Management Engine (CFME) attacker need user-level authentication. AV:N => The vulnerability is in the web application and reasonably requires network interaction with the server. I:L => If an attacker exploited CSV injection against users then it would be an integrity and availability breach of the user's machine and not of CloudForms server where the CloudForms Management Engine (CFME) is deployed and hosted. This CSV injection is only intended to work on Windows and not on Linux machines, CFME can be only installed on Linux systems. One more reason being, if an attacker is able to get exploit working against the admin of CFME he will be able to modify CloudForms Management Engine's data but not of CloudForms Server's since those are two different entities with separate authentication mechanisms. A:N => As mentioned above, CFME and Server are two different entities with separate authentication mechanisms, if an attacker gets admin access of CFME web application, it is assumed that he can not harm availability of CloudForms server.