PatchTheCVECVE-2020-14369: This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end
CVE-2020-14369 is a medium-severity flaw (CVSS 6.3) affecting cloudforms. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.
Why this priority
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.3% (top 73%) |
| CISA exploited list | No |
| Weakness | CWE-352 |
| Published | 2020-12-02 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-14369?
cloudforms: upgrade to newer than 5.11. Exact commands for each OS are on this page.
Is CVE-2020-14369 being exploited?
CVE-2020-14369 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-14369 affect?
CVE-2020-14369 affects cloudforms. Severity is medium (CVSS 6.3). This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forge
How urgent is CVE-2020-14369?
Priority 34/100. On your watchlist
Software pages
Related CVEs
- CVE-2012-5605 LOW 3.3 UPGRADE A flaw was found in Grinder, a component of Red Hat CloudForms
- CVE-2012-4574 MEDIUM 5.5 UPGRADE A flaw was found in Pulp, as used in Red Hat CloudForms
- CVE-2020-25716 HIGH 8.1 UPGRADE A flaw was found in Cloudforms
- CVE-2020-14325 CRITICAL 9.1 UPGRADE Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows ma
- CVE-2020-10783 HIGH 8.3 DOWNGRADE Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw