Description
Red Hat CloudForms 4.7 and 5 leads to insecure direct object references (IDOR) and functional level access control bypass due to missing privilege check. Therefore, if an attacker knows the right criteria, it is possible to access some sensitive data within the CloudForms.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | CloudForms | 4.7 and 5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | cfme +1 | 5.11.7.3-1.el8cf | RHSA-2020:3358 |
Advisories 1
- RHSA-2020:3358 Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update Red Hat Security Advisories (RHSA) · Jun 27, 2026