CVE-2016-6338 Security feature bypass in n/a
Physically proximate attackers can bypass webadmin session timeouts by triggering repeating queries via UI selections in RHEV-M.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-6338?
CVE-2016-6338 is a medium-severity vulnerability in n/a, published on 20 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries.
Weakness: CWE-284
Which versions are affected by CVE-2016-6338?
It affects 1 product.
Linux distribution packages (20)
ovirt-engine Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-backend Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-dbscripts Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-extensions-api-impl Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-extensions-api-impl-javadoc Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-lib Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-restapi Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-setup Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-setup-base Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-setup-plugin-ovirt-engine Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-setup-plugin-ovirt-engine-common Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-setup-plugin-vmconsole-proxy-helper Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-setup-plugin-websocket-proxy Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-tools Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-tools-backup Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-userportal Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-vmconsole-proxy-helper Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-webadmin-portal Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
ovirt-engine-websocket-proxy Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
rhevm Red Hat:rhev_manager:4 | All versions | 0:4.1.8.2-0.1.el7 |
Products include Redhat Enterprise Virtualization.
How do I fix CVE-2016-6338?
Apply the vendor's patch.
Is CVE-2016-6338 being exploited?
There is no known exploitation of CVE-2016-6338 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w4h4-7mqm-9j6c, RHSA-2017:3427.