{"id":"CVE-2020-10783","aliases":["EUVD-2020-3196","RHSA-2020:3358","RHSA-2020:3574"],"status":"published","title":"Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update","description":"Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01,"percentile":0.63254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2020-08-11T12:35:13Z","modified":"2026-06-27T10:11:04Z","affected":[{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.7.3-1.el8cf"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.11::el8","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.11.7.3-1.el8cf"}]}],"bundled":8},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.16.0-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.16.0-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.16.0-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.16.0-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.16.0-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.16.0-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.16.0-1.el7cf"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.16.0-1.el7cf"}]}],"bundled":4}],"products":[{"vendor":"[unknown]","product":"cloudforms"},{"vendor":"redhat","product":"cloudforms"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847811","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Vendor Advisory","report"]},{"url":"https://access.redhat.com/security/cve/cve-2020-10783","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3358","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#critical","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_cloudforms/5.0/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671330","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1741310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1753586","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757128","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770197","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1809033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1810040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1810477","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1826410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1832278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1834219","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1836125","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1836158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1837993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1838704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1839770","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1845281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1846281","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847605","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847628","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847647","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847860","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1848265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1850952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1855713","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1855739","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3358.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10777","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10777","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10777","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10778","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10778","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10778","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10779","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10779","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10779","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10780","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10780","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10780","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10783","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10783","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10783","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14296","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14296","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14296","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14324","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14324","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14324","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-14325","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14325","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14325","tags":["advisory"]},{"url":"https://github.com/ManageIQ/manageiq/security/advisories/GHSA-84f5-5g5v-g8vr","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3574","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811145","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3574.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-10783","description":"Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files.","status":"published","published":"2020-08-11T12:35:13Z","modified":"2024-08-04T11:14:15.473Z","updated_at":"2026-11-02T14:35:47.877975Z"}],"euvd":[{"id":"EUVD-2020-3196","description":"Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files.","status":"published","published":"2020-08-11T12:35:13Z","modified":"2024-08-04T11:14:15Z","updated_at":"2026-11-03T03:07:48.918317Z"}],"nvd":[{"id":"CVE-2020-10783","description":"Red Hat CloudForms 4.7 and 5 is affected by a role-based privilege escalation flaw. An attacker with EVM-Operator group can perform actions restricted only to EVM-Super-administrator group, leads to, exporting or importing administrator files.","status":"published","published":"2020-08-11T13:15:12.163Z","modified":"2026-06-17T02:48:26.153Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:10.994748Z"}],"osv":[{"id":"RHSA-2020:3358","title":"Red Hat Security Advisory: CloudForms 5.0.7 bug fix and enhancement update","status":"published","published":"2024-09-16T04:32:04Z","modified":"2026-06-27T10:10:58Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3574","title":"Red Hat Security Advisory: CloudForms 4.7.16 security, bug fix and enhancement update","status":"published","published":"2024-09-16T04:32:11Z","modified":"2026-06-27T10:11:04Z","cvss":[{"version":"3.1","score":9.9,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L","level":"critical"}],"updated_at":"2026-11-02T15:53:07.57369Z"}]}}