PatchTheCVECVE-2020-14325: Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows ma
CVE-2020-14325 is a critical-severity flaw (CVSS 9.1) affecting cloudforms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.1 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.1% (top 35%) |
| CISA exploited list | No |
| Published | 2020-08-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-14325?
cloudforms: upgrade to 5.11.7.0. Exact commands for each OS are on this page.
Is CVE-2020-14325 being exploited?
CVE-2020-14325 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-14325 affect?
CVE-2020-14325 affects cloudforms. Severity is critical (CVSS 9.1). Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group
How urgent is CVE-2020-14325?
Priority 58/100. Critical severity; Remotely exploitable, no login, no user action; On your watchlist
Related CVEs
- CVE-2012-5605 LOW 3.3 UPGRADE A flaw was found in Grinder, a component of Red Hat CloudForms
- CVE-2012-4574 MEDIUM 5.5 UPGRADE A flaw was found in Pulp, as used in Red Hat CloudForms
- CVE-2020-25716 HIGH 8.1 UPGRADE A flaw was found in Cloudforms
- CVE-2020-14369 MEDIUM 6.3 UPGRADE This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end
- CVE-2020-10783 HIGH 8.3 DOWNGRADE Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw