CVE-2020-14324

Severity: critical (CVSS 9.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-08-11 · updated 2026-06-17
Weakness: CWE-78

Description

A high severity vulnerability was found in all active versions of Red Hat CloudForms before 5.11.7.0. The out of band OS command injection vulnerability can be exploited by authenticated attacker while setuping conversion host through Infrastructure Migration Solution. This flaw allows attacker to execute arbitrary commands on CloudForms server.

Affected products

Red Hat CloudForms: before 5.11.7.0 — fixed in 5.11.7.0

How to fix

Upgrade to a fixed version: Red Hat CloudForms 5.11.7.0. Check the vendor advisory for mitigations.

References

https://access.redhat.com/security/cve/cve-2020-14324
https://bugzilla.redhat.com/show_bug.cgi?id=1855713
https://access.redhat.com/security/cve/cve-2020-14324
https://bugzilla.redhat.com/show_bug.cgi?id=1855713

Get alerted when CVE-2020-14324 or the next vulnerability affects your stack