CVE-2014-3573
published 2014-10-18CVE-2014-3573: The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows…
PriorityP337medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
1.76%
75.4th percentile
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | enterprise_virtualization_manager | <= 3.4.1 | — |
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
Engine: XML eXternal Entity (XXE) flaw in backend module
vendor_redhat·2014-09-04·CVSS 6.5
CVE-2014-3573 [MEDIUM] CWE-611 Engine: XML eXternal Entity (XXE) flaw in backend module
Engine: XML eXternal Entity (XXE) flaw in backend module
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.
It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the ovirt-engine server, and potentially perform other more advanced XML External Entity (XXE) attacks.
Package: org.ovirt.engine-root (Red Hat Storage 2.1) - Will not fix
Package: org.ovirt.
GHSA
GHSA-6whg-r3w4-fhjh: The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3
ghsa_unreviewed·2022-05-17
CVE-2014-3573 [MEDIUM] CWE-20 GHSA-6whg-r3w4-fhjh: The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-3573 ovirt-engine-backend: oVirt Engine: XML eXternal Entity (XXE) flaw in backend module
bugzilla·2014-09-07·CVSS 6.5
CVE-2014-3573 [MEDIUM] CVE-2014-3573 ovirt-engine-backend: oVirt Engine: XML eXternal Entity (XXE) flaw in backend module
CVE-2014-3573 ovirt-engine-backend: oVirt Engine: XML eXternal Entity (XXE) flaw in backend module
It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the ovirt-engine server, and potentially perform other more advanced XML External Entity (XXE) attacks.
Discussion:
in ovirt-engine-backend-3.5.0-0.0.master.20140911085455.gite1c5ffd.el6.noarch
---
oVirt 3.4.4 has been released.
Bugzilla
CVE-2014-3573 oVirt Engine: XML eXternal Entity (XXE) flaw in backend module
bugzilla·2014-08-01·CVSS 6.5
CVE-2014-3573 [MEDIUM] CVE-2014-3573 oVirt Engine: XML eXternal Entity (XXE) flaw in backend module
CVE-2014-3573 oVirt Engine: XML eXternal Entity (XXE) flaw in backend module
IssueDescription:
It was discovered that, when loading XML/RSDL documents, the oVirt Engine back end module used an insecure DocumentBuilderFactory. A remote, authenticated attacker could use this flaw to read files accessible to the user running the ovirt-engine server, and potentially perform other more advanced XML External Entity (XXE) attacks.
Discussion:
Acknowledgements:
This issue was discovered by Arun Babu Neelicattu of Red Hat Product Security.
---
This issue has been addressed in following products:
RHEV Manager version 3.4
Via RHSA-2014:1161 https://rhn.redhat.com/errata/RHSA-2014-1161.html
2014-10-18
Published