CVE-2020-10780

Published: Aug 11, 2020Modified: Jun 17, 2026

6.3

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Exploitability: 2.1 / Impact: 4.2

Source: NVD

Description

Red Hat CloudForms 4.7 and 5 is affected by CSV Injection flaw, a crafted payload stays dormant till a victim export as CSV and opens the file with Excel. Once the victim opens the file, the formula executes, triggering any number of possible events. While this is strictly not an flaw that affects the application directly, attackers could use the loosely validated parameters to trigger several attack possibilities.

Affected (2)

Products: Redhat: Cloudforms Management Engine

1 product

Cloudforms Management Engine

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Redhat Cloudforms Management Engine	Version 4.7
Redhat Cloudforms Management Engine	Version 5.0

Related CWEs

Improper Neutralization of Formula Elements in a CSV File

The product saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by a spreadsheet product.

References (4)

https://access.redhat.com/security/cve/cve-2020-10780

Source: secalert@redhat.com

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1847794

Source: secalert@redhat.com

Issue TrackingVendor Advisory

https://access.redhat.com/security/cve/cve-2020-10780

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1847794

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingVendor Advisory

Timeline

No history available yet.