CVE-2014-7851 Auth bypass in n/a

High 7.5 Published 16 Oct 2017 Updated 6 Aug 2024

Authenticated attackers can hijack sessions by reusing tokens after logout, gaining other users' privileges in oVirt.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2014-7851?

CVE-2014-7851 is a high-severity authentication bypass vulnerability in n/a, published on 16 Oct 2017. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user.

Weakness: CWE-264

Which versions are affected by CVE-2014-7851?

It affects 2 products.

Linux distribution packages (17)

`rhevm` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-backend` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-dbscripts` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-extensions-api-impl` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-extensions-api-impl-javadoc` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-lib` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-restapi` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-setup` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-setup-base` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-setup-plugin-allinone` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-setup-plugin-ovirt-engine` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-setup-plugin-ovirt-engine-common` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-setup-plugin-websocket-proxy` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-tools` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-userportal` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-webadmin-portal` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`
`rhevm-websocket-proxy` Red Hat:rhev_manager:3	All versions	`0:3.5.0-0.32.el6ev`

Products include Ovirt Ovirt, Redhat Ovirt-Engine.

How do I fix CVE-2014-7851?

Apply the vendor's patch.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2014-7851 being exploited?

There is no known exploitation of CVE-2014-7851 in the wild and no public exploit code.

Sources

Also known as GHSA-353g-73mj-6wf9, RHBA-2015:0230.