CVE-2013-0168 Missing authorization in n/a

Medium 4.0 Published 12 Mar 2013 Updated 6 Aug 2024

Remote authenticated storage admins can cause denial of service by consuming free space in other storage domains due to improper permission checks.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2013-0168?

CVE-2013-0168 is a medium-severity missing authorization vulnerability in n/a, published on 12 Mar 2013. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The MoveDisk command in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service (free space consumption of other storage domains) via unspecified vectors.

Weakness: CWE-264

Which versions are affected by CVE-2013-0168?

It affects 1 product.

Products include Redhat Enterprise Virtualization Manager.

How do I fix CVE-2013-0168?

Apply the vendor's patch.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2013-0168 being exploited?

There is no known exploitation of CVE-2013-0168 in the wild and no public exploit code.

Sources

Also known as GHSA-cw86-5m65-cvg3.