Red Hat Security AdvisoryRHSA-2014:0506
Red Hat Enterprise Virtualization Manager 3.4.0 update
Released 2014-06-09 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- RHEV-M 3.4 rhevm-3.4.0-0.21.el6ev, rhevm-backend-3.4.0-0.21.el6ev, rhevm-dbscripts-3.4.0-0.21.el6ev +12
Fixes 2 records
Priority LOW 34
Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.01757 · Published 2014-09-08 · Fixed
Priority LOW 23
The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive information via a crafted web page.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01334 · Published 2014-09-08 · Fixed CWE-200
