Skip to content
Fencer Vulns
medium 6.3

CVE-2020-14369 json

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted ac…

published 2020-12-02 5 y ago modified 2026-06-17 4 mo ago also EUVD-2020-6510

cvss
6.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 27%
public exploits
0
none known

Summary

This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.

Patch / fix

  • cfme-gemset cloudforms managementengine 5.11 5.11.8.1-1.el8cf

red hat advisories RHSA-2020:4134

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-14369 updated cvss 6.3

CloudForms: Cross Site Request Forgery in API notifications

  • Red Hat CloudForms Management Engine 5.11 cfme-gemset 5.11.8.1-1.el8cf
    fixed: vendor fix RHSA-2020:4134
  • Red Hat CloudForms Management Engine 5.11 cfme 5.11.8.1-1.el8cf, repmgr10 4.0.6-4.el8cf, ansible-tower 3.6.5-1.el8at, cfme-appliance 5.11.8.1-1.el8cf, cfme-appliance-tools 5.11.8.1-1.el8cf, cfme-appliance-common 5.11.8.1-1.el8cf, +2 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 27% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
NVD 2.0 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

  • n/a CloudForms

Classification

Weakness
  • CWE-352 Cross-Site Request Forgery

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.