CVE-2014-0152

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.

Metrics

CVSS 2.0 6.8/10AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://gerrit.ovirt.org/#/c/25959/Patch
http://www.ovirt.org/Security_advisoriesPatch, Vendor Advisory
http://gerrit.ovirt.org/#/c/25959/Patch
http://www.ovirt.org/Security_advisoriesPatch, Vendor Advisory

Timeline

Published: Sep 8, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01534.3The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive informa CVE-2014-01545.0oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote at CVE-2014-01555.5The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic CVE-2014-01569.8Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argument CVE-2014-01574.3Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 CVE-2014-01588.8Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service CVE-2014-01595.0Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial o CVE-2014-01607.5The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem CVE-2014-01615.9ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or CVE-2014-01626.0The Sheepdog backend in OpenStack Image Registry and Delivery Service (Glance) 2013.2 before 2013.2.4 and icehouse before icehouse-rc2 allow CVE-2014-01638.8Openshift has shell command injection flaws due to unsanitized data being passed into shell commands.CVE-2014-01642.1openshift-origin-broker-util, as used in Red Hat OpenShift Enterprise 1.2.7 and 2.0.5, uses world-readable permissions for the mcollective c