CVE-2014-7823

libvirt < 1.2.11 - Unauthenticated VNC Password Exposure via virDomainGetXMLDesc API

Title source: llm
STIX 2.1

Description

The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.

References (8)

Core 8
Core References
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62058
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60895
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-201412-04.xml
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/62303
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2404-1
Mailing List vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-updates/2014-11/msg00083.html
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/60010
Patch, Vendor Advisory x_refsource_confirm
http://security.libvirt.org/2014/0007.html

Scores

EPSS 0.0191
EPSS Percentile 77.6%

Details

CWE
CWE-255
Status published
Products (11)
redhat/libvirt 1.2.0
redhat/libvirt 1.2.1
redhat/libvirt 1.2.2
redhat/libvirt 1.2.3
redhat/libvirt 1.2.4
redhat/libvirt 1.2.5
redhat/libvirt 1.2.6
redhat/libvirt 1.2.7
redhat/libvirt 1.2.8
redhat/libvirt 1.2.9
... and 1 more
Published Nov 13, 2014
Tracked Since Feb 18, 2026