High severity · published Oct 16, 2017
CVE-2014-7851
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session…
7.5
CVSS
1%
EPSS
No
On KEV
Description
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OV
Ovirt · Ovirt
3.3.2; 3.4.0 · source: NVD
OV
Ovirt-engine · Redhat
3.2.2; 3.3; 3.3; 3.3; 3.3.0.1; 3.3.1; +22 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-7851
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-7851
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1161730
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1165311
More from Ovirt
9.8
CVE-2018-1072
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files
8.1
CVE-2019-3879
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be…
7.8
CVE-2018-1075
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning
7.2
CVE-2018-1074
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to…
6.6
CVE-2017-15113
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking