CVE-2014-0152 Auth bypass in n/a

What is CVE-2014-0152?

CVE-2014-0152 is a medium-severity authentication bypass vulnerability in n/a, published on 8 Sep 2014. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.

Which versions are affected by CVE-2014-0152?

It affects 2 products.

Products include Ovirt Ovirt, Redhat Ovirt-Engine.

How do I fix CVE-2014-0152?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2014-0152 being exploited?

There is no known exploitation of CVE-2014-0152 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2018-1074 Information disclosure in ovirt-engine High 7.7
• CVE-2014-7851 Auth bypass in n/a High 7.5
• CVE-2017-15113 Information disclosure in ovirt-engine High 7.2
• CVE-2019-3879 Missing authorization in ovirt-engine Medium 6.5
• CVE-2019-10194 Information disclosure in ovirt-engine-metrics Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-73j8-g9r9-3463.