CVE-2014-7851
published 2017-10-16CVE-2014-7851: oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of…
PriorityP339high7.5CVSS 3.0
AVNACHPRLUINSUCHIHAH
EPSS
1.00%
58.9th percentile
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user.
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ovirt | ovirt | — | — |
| ovirt | ovirt | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
| redhat | ovirt-engine | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ovirt-engine-webadmin: does not invalidate all sessions upon logout
vendor_redhat·2015-02-17·CVSS 7.5
CVE-2014-7851 [HIGH] CWE-613 ovirt-engine-webadmin: does not invalidate all sessions upon logout
ovirt-engine-webadmin: does not invalidate all sessions upon logout
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user.
It was found that oVirt did not correctly terminate sessions when a user logged out from the web interface. Upon logout, only the engine session was invalidated but the restapi session persisted. An attacker able to obtain the session data, and able to log in with their own credentials, could replace their session token with the stolen token and elevate their privileges to those of the victim user. Note that in order for this flaw to be exploited, the
GHSA
GHSA-353g-73mj-6wf9: oVirt 3
ghsa_unreviewed·2022-05-13
CVE-2014-7851 [HIGH] GHSA-353g-73mj-6wf9: oVirt 3
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user.
No detection rules found.
No public exploits indexed.
2017-10-16
Published