CVE-2014-7851 | BDVDB-2026-91622 Detail

Description#

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://bugzilla.redhat.com/show_bug.cgi?id=1161730
https://bugzilla.redhat.com/show_bug.cgi?id=1165311

Exploit#

No public exploit known

History#

Version 12017-10-16Record published in the CVE List.
Version 22024-08-06Most recent update recorded in the CVE List.