CVE-2016-6338

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for...

6.8 MediumFix available

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.52%Down 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 6.8

Record: CVE-2016-6338
CVSS 3.0: 6.8 MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-6338
Updated: 2026-11-02

EUVDEUVD-2016-7265 No score

Record: EUVD-2016-7265
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w4h4-7mqm-9j6c 6.8

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for...

Record: GHSA-w4h4-7mqm-9j6c
CVSS 3.0: 6.8 MediumCVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

OSVRHSA-2017:3427 3.8

Red Hat Security Advisory: org.ovirt.engine-root security, bug fix, and enhancement update

Record: RHSA-2017:3427
CVSS 3.0: 3.8 LowCVSS:3.0/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L
Updated: 2026-11-02

Affected products

redhat enterprise virtualization

Affected packages

Affected packages
Package	Affected	Fixed
`ovirt-engine` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-backend` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-dbscripts` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-extensions-api-impl` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-extensions-api-impl-javadoc` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-lib` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-restapi` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-setup` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-setup-base` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-setup-plugin-ovirt-engine` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`ovirt-engine-setup-plugin-ovirt-engine-common` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-setup-plugin-vmconsole-proxy-helper` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-setup-plugin-websocket-proxy` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-tools` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-tools-backup` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-userportal` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-vmconsole-proxy-helper` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-webadmin-portal` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`ovirt-engine-websocket-proxy` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7
`rhevm` Red Hat:rhev_manager:4	before 0:4.1.8.2-0.1.el7	0:4.1.8.2-0.1.el7

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-6338 is a medium vulnerability (CVSS 6.8) in Redhat Enterprise Virtualization, published April 20, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in ovirt-engine 0:4.1.8.2-0.1.el7.

References

Show 9 moreShow less