Cross site request forgery (csrf)

2014-09-0814:55:00

PRIOn knowledge base

www.prio-n.com

6.4 Medium

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

65.8%

JSON

The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page.

CPENameOperatorVersion
ovirtle3.4.0

CPE	Name	Operator	Version
	ovirt	le	3.4.0

References

gerrit.ovirt.org/

www.ovirt.org/Security_advisories