PT-2017-8968 · Red Hat · Red Hat Enterprise Virtualization Manager

Greg Sheremeta

·

Publicado

2017-04-20

·

Atualizado

2023-02-12

·

CVE-2016-6338

CVSS v3.1

6.8

Média

VetorAV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization Manager (RHEV-M) version 4.0
Description The issue allows physically proximate attackers to bypass a webadmin session timeout restriction. This is achieved via vectors related to UI selections, which trigger repeating queries.
Recommendations For RHEV-M version 4.0, consider implementing a custom session timeout mechanism to mitigate the risk of session bypass. As a temporary workaround, restrict access to the webadmin interface to minimize the risk of exploitation.

Exploit

Correção

Improper Access Control

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-284

Identificadores relacionados

CVE-2016-6338
RHSA-2017:3427

Produtos afetados

Red Hat Enterprise Virtualization Manager