{"id":"CVE-2020-10777","aliases":["EUVD-2020-3190","RHSA-2020:3358"],"status":"published","title":"Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update","description":"A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00661,"percentile":0.52126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2020-08-11T12:17:53Z","modified":"2026-06-27T10:10:58Z","affected":[{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.7.3-1.el8cf"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.7.3-1.el8cf"}]}],"bundled":8}],"products":[{"vendor":"[unknown]","product":"cloudforms"},{"vendor":"redhat","product":"cloudforms"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847605","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://access.redhat.com/security/cve/cve-2020-10777","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3358","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_cloudforms/5.0/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753586","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1809033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1810040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1810477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1826410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1832278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1836125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1836158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1837993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1838704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1839770","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1846281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1855713","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1855739","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3358.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10777","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10778","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10779","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10780","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10780","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10783","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14296","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14324","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14325","tags":["advisory"]},{"url":"https://github.com/ManageIQ/manageiq/security/advisories/GHSA-84f5-5g5v-g8vr","tags":["article"]}],"sources":{"cve":[{"id":"CVE-2020-10777","description":"A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms.","status":"published","published":"2020-08-11T12:17:53Z","modified":"2024-08-04T11:14:15.588Z","updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-3190","description":"A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms.","status":"published","published":"2020-08-11T12:17:53Z","modified":"2024-08-04T11:14:15Z","updated_at":"2026-11-03T03:07:48.918317Z"}],"nvd":[{"id":"CVE-2020-10777","description":"A cross-site scripting flaw was found in Report Menu feature of Red Hat CloudForms 4.7 and 5. An attacker could use this flaw to execute a stored XSS attack on an application administrator using CloudForms.","status":"published","published":"2020-08-11T13:15:11.96Z","modified":"2026-06-17T02:48:25.507Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"RHSA-2020:3358","title":"Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update","status":"published","published":"2024-09-16T04:32:04Z","modified":"2026-06-27T10:10:58Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:07.072948Z"}]}}