CVE-2020-14301 Information disclosure in libvirt
An attacker can access sensitive HTTP cookies from network-based disks via the domain XML dump in libvirt.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-14301?
CVE-2020-14301 is a medium-severity vulnerability in Netapp Ontap Select Deploy Administration Utility, published on 27 May 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.
Weakness: CWE-212
Which versions are affected by CVE-2020-14301?
It affects 13 products.
Products include Netapp Ontap Select Deploy Administration Utility, Redhat Codeready Linux Builder, Redhat Enterprise Linux, Redhat Enterprise Linux Eus, Redhat Enterprise Linux for Ibm Z Systems, Redhat Enterprise Linux for Ibm Z Systems Eus and 7 more.
How do I fix CVE-2020-14301?
Upgrade to a fixed version.
Is CVE-2020-14301 being exploited?
There is no known exploitation of CVE-2020-14301 in the wild and no public exploit code.
Other vulnerabilities in Netapp Ontap Select Deploy Administration Utility
- CVE-2020-35527 Memory corruption in sqlite
- CVE-2020-11656 Use after free in n/a
- CVE-2019-5509 Code injection in ONTAP Select Deploy administration utility
- CVE-2019-5504 Missing authorization in ONTAP Select Deploy administration utility
- CVE-2019-5505 Information disclosure in ONTAP Select Deploy administration utility
All Netapp Ontap Select Deploy Administration Utility vulnerabilities
Sources
Also known as GHSA-5qrf-45p7-8vrc.