Description
This release fixes a Cross Site Request Forgery vulnerability was found in Red Hat CloudForms which forces end users to execute unwanted actions on a web application in which the user is currently authenticated. An attacker can make a forgery HTTP request to the server by crafting custom flash file which can force the user to perform state changing requests like provisioning VMs, running ansible playbooks and so forth.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | CloudForms | cfme-gemset 5.11.8.1-1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat CloudForms 5 | cfme-gemset | 5.11.8.1-1.el8cf | RHSA-2020:4134 |
Advisories 1
- RHSA-2020:4134 Red Hat Security Advisory: CloudForms 5.0.8 security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025