PT-2020-13974 · Ovirt · Ovirt

Chen Huiliang + 1 · CVE-2020-14333 · Published 2020-08-18 · Updated 2023-02-12

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions ovirt versions 4.4 and earlier

Description A flaw was found in Ovirt Engine's web interface where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other confidential information, or impersonate them within the application's context.

Recommendations For ovirt versions 4.4 and earlier, update to a version that includes the fix for this issue to prevent reflected cross-site scripting attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-14333

RHSA-2020:3807

Affected Products

Ovirt

References · 4

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14333 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-14333 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-14333 · Security Note
• https://t.me/cvenotify/6747 · Telegram Post