CVE-2020-14325

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Red Hat CloudForms before 5.11.7.0 was vulnerable to the User Impersonation authorization flaw which allows malicious attacker to create existent and non-existent role-based access control user, with groups and roles. With a selected group of EvmGroup-super_administrator, an attacker can perform any API request as a super administrator.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected software

Vendor	Product	Versions
n/a	CloudForms	cfme 5.11.7.0

References

https://access.redhat.com/security/cve/cve-2020-14325Mitigation, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1855739Issue Tracking, Mitigation, Vendor Advisory
https://access.redhat.com/security/cve/cve-2020-14325Mitigation, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1855739Issue Tracking, Mitigation, Vendor Advisory

Timeline

Published: Aug 11, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-143267.5A vulnerability was found in RESTEasy, where RootNode incorrectly caches routes. This issue results in hash flooding, leading to slower requ CVE-2020-143275.5A Server-side request forgery (SSRF) flaw was found in Ansible Tower in versions before 3.6.5 and before 3.7.2. Functionality on the Tower s CVE-2020-143283.3A flaw was found in Ansible Tower in versions before 3.7.2. A Server Side Request Forgery flaw can be abused by supplying a URL which could CVE-2020-143293.3A data exposure flaw was found in Ansible Tower in versions before 3.7.2, where sensitive data can be exposed from the /api/v2/labels/ endpo CVE-2020-14336.5An information disclosure vulnerability exists when Microsoft Edge PDF Reader improperly handles objects in memory, aka 'Microsoft Edge PDF CVE-2020-143305.5An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content a CVE-2020-143316.6A flaw was found in the Linux kernel’s implementation of the invert video code on VGA consoles when a local attacker attempts to resize the CVE-2020-143325.5A flaw was found in the Ansible Engine when using module_args. Tasks executed with check mode (--check-mode) do not properly neutralize sens CVE-2020-143336.1A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, CVE-2020-143348.8A flaw was found in Red Hat Satellite 6 which allows privileged attacker to read cache files. These cache credentials could help attacker to CVE-2020-143355.5A flaw was found in Red Hat Satellite, which allows a privileged attacker to read OMAPI secrets through the ISC DHCP of Smart-Proxy. This fl CVE-2020-143366.5A flaw was found in the Restricted Security Context Constraints (SCC), where it allows pods to craft custom network packets. This flaw allow