PT-2017-6113 · Red Hat · Ovirt

Vincent Danen · Published 2017-10-16 · Updated 2023-02-13 · CVE-2014-7851

Positive Technologies (AI Summary)

CVSS v2.0

6.0

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: oVirt versions 3.2.2 through 3.5.0

Description: The issue allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user, due to the failure to invalidate the restapi session after logout from the webadmin.

Recommendations: For oVirt versions 3.2.2 through 3.5.0, consider implementing a workaround to manually invalidate the restapi session after logout from the webadmin until a patch is available. As a temporary workaround, restrict access to sensitive operations that rely on session tokens to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-7851

Affected Products

Ovirt

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2014-7851 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1165311 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1161730 · Note