CVE-2020-10780
Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.
- Record
CVE-2020-10780- CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N - CVSS 2.0
- 4.9 Medium
AV:N/AC:M/Au:S/C:P/I:P/A:N - Weakness
- CWE-1236
- Updated
- 2026-11-02
CVE List No score
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.
- Record
CVE-2020-10780- Updated
- 2026-11-02
EUVDEUVD-2020-3193 No score
Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.
- Record
EUVD-2020-3193- Updated
- 2026-11-03
OSVRHSA-2020:3358
Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update
- Record
RHSA-2020:3358- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cfme-gemsetRed Hat:cloudforms_managementengine:5.11::el8 |
before 0:5.11.7.3-1.el8cf | 0:5.11.7.3-1.el8cf |
cfmeRed Hat:cloudforms_managementengine:5.11::el8 |
before 0:5.11.7.3-1.el8cf | 0:5.11.7.3-1.el8cf |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10780 is a medium vulnerability (CVSS 6.3) in [unknown] Cloudforms, published August 11, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.70%, the 53rd percentile. Fixed in cfme-gemset 0:5.11.7.3-1.el8cf.
References
bugzilla.redhat.com/show_bug.cgi?id=1847794
access.redhat.com/security/cve/cve-2020-10780
Show 58 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3358.json
cve.org/CVERecord?id=CVE-2020-10777
nvd.nist.gov/vuln/detail/CVE-2020-10777
github.com/ManageIQ/manageiq/security/advisories/GHSA-84f5-5g5v-g8vr