CVE-2020-10780

Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel

published August 11, 2020

CVSS
—
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00701 · 52.7th percentile
Published
2020-08-11T13:32Z
EPSS history
Timeline
  • 11 AUG 13:32Z
    Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel
    cvelistv5