Cross-Site Request Forgery Vulnerability in CloudForms by Red Hat

CVE-2017-2653

What is CVE-2017-2653?

CloudForms, prior to version 5.7.2.1, exposes certain unused delete routes that can be manipulated through GET requests instead of the intended POST requests. This flaw can potentially allow an attacker to circumvent XSRF protections, providing an opportunity to exploit the application using various attack vectors. Successful exploitation would likely require additional techniques, such as cross-site scripting, to fully leverage this vulnerability.

References