CVE-2014-0152

2014-09-0814:55:02

[email protected]

web.nvd.nist.gov

cve-2014-0152

session fixation

ovirt

web admin interface

remote attackers

web sessions

6.8 Medium

AI Score

Confidence

Low

6.8 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

0.007 Low

EPSS

Percentile

79.6%

JSON

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.

Affected configurations

NVD

Node

ovirtovirtRange≤3.4.0

redhatovirt-engineMatch3.0.0

redhatovirt-engineMatch3.1.0

redhatovirt-engineMatch3.2.0

redhatovirt-engineMatch3.3.0

redhatovirt-engineMatch3.3.2rc1

redhatovirt-engineMatch3.3.3

redhatovirt-engineMatch3.3.4

redhatovirt-engineMatch3.3.5

redhatovirt-engineMatch3.4.0rc1

CPENameOperatorVersion
ovirt:ovirtovirtle3.4.0
redhat:ovirt-engineredhat ovirt-engineeq3.0.0
redhat:ovirt-engineredhat ovirt-engineeq3.1.0
redhat:ovirt-engineredhat ovirt-engineeq3.2.0
redhat:ovirt-engineredhat ovirt-engineeq3.3.0
redhat:ovirt-engineredhat ovirt-engineeq3.3.2
redhat:ovirt-engineredhat ovirt-engineeq3.3.3
redhat:ovirt-engineredhat ovirt-engineeq3.3.4
redhat:ovirt-engineredhat ovirt-engineeq3.3.5
redhat:ovirt-engineredhat ovirt-engineeq3.4.0

CPE	Name	Operator	Version
ovirt:ovirt	ovirt	le	3.4.0
redhat:ovirt-engine	redhat ovirt-engine	eq	3.0.0
redhat:ovirt-engine	redhat ovirt-engine	eq	3.1.0
redhat:ovirt-engine	redhat ovirt-engine	eq	3.2.0
redhat:ovirt-engine	redhat ovirt-engine	eq	3.3.0
redhat:ovirt-engine	redhat ovirt-engine	eq	3.3.2
redhat:ovirt-engine	redhat ovirt-engine	eq	3.3.3
redhat:ovirt-engine	redhat ovirt-engine	eq	3.3.4
redhat:ovirt-engine	redhat ovirt-engine	eq	3.3.5
redhat:ovirt-engine	redhat ovirt-engine	eq	3.4.0