CVEvulnerability

CVE-2014-7851

7.5 HIGH Published 2017-10-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-10-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
7.5 HIGH — CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
Weaknesses
CWE-264

Description

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user.

Affected configurations

• ovirt ovirt 3.3.2 • ovirt ovirt 3.4.0 • redhat ovirt-engine 3.2.2 • redhat ovirt-engine 3.3 • redhat ovirt-engine 3.3.0.1 • redhat ovirt-engine 3.3.1 • redhat ovirt-engine 3.3.2 • redhat ovirt-engine 3.3.3 • redhat ovirt-engine 3.3.4 • redhat ovirt-engine 3.3.5 • redhat ovirt-engine 3.4.0 • redhat ovirt-engine 3.4.1 • redhat ovirt-engine 3.4.2 • redhat ovirt-engine 3.4.3 • redhat ovirt-engine 3.4.4 • redhat ovirt-engine 3.5.0

Related

Weakness · not in database (1)

References