CVE-2014-0151

oVirt Engine < 3.5.0 - Cross-Site Request Forgery via REST API

Title source: llm
STIX 2.1

Description

Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of users for requests that perform unspecified actions via a REST API request.

References (3)

Core 3
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1077441
Vendor Advisory vendor-advisory x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2015-0158.html
Vendor Advisory x_refsource_confirm
http://www.ovirt.org/OVirt_3.5_Release_Notes

Scores

EPSS 0.0064
EPSS Percentile 46.4%

Details

CWE
CWE-352
Status published
Products (1)
redhat/ovirt-engine < 3.5.0
Published Feb 13, 2015
Tracked Since Feb 18, 2026