PT-2017-6113 · Red Hat · Ovirt
CVSS v2.0
6.0
Média
| Vetor | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
oVirt versions 3.2.2 through 3.5.0
Description:
The issue allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user, due to the failure to invalidate the restapi session after logout from the webadmin.
Recommendations:
For oVirt versions 3.2.2 through 3.5.0, consider implementing a workaround to manually invalidate the restapi session after logout from the webadmin until a patch is available. As a temporary workaround, restrict access to sensitive operations that rely on session tokens to minimize the risk of exploitation.
Correção
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Ovirt