{"id":"CVE-2013-2144","aliases":["EUVD-2013-2109","GHSA-5q6m-qgpq-gv3p","RHSA-2013:0888"],"status":"published","title":"Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions...","description":"Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.","severity":{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01244,"percentile":0.69436,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2013-07-03T18:00:00Z","modified":"2026-06-29T10:05:32Z","fixes":[{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-config","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-genericapi","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-notification-service","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-allinone","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools-common","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","fixed_in":["0:3.2.0-11.30.el6ev"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-config","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-genericapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-notification-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-allinone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.2.0-11.30.el6ev"}]}]}],"products":[{"vendor":"redhat","product":"enterprise_virtualization_manager"}],"references":[{"url":"http://rhn.redhat.com/errata/RHSA-2013-0888.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-2144","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-5q6m-qgpq-gv3p"},{"url":"https://access.redhat.com/errata/RHSA-2013:0888","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.2/html/Technical_Notes/chap-RHSA-2013-0888.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=723206","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=754334","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=829625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=837907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=838457","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=838469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=838470","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=839205","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=843058","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=843410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=845022","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=848398","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=854489","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=854535","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=854540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=854964","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=855630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=858742","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=859762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=861098","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=861576","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=862797","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=866123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=866889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=867543","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=868626","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=870159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=870352","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=871371","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=871802","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=872506","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=873581","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=874080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=875527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=875528","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=875814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=876109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=876235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=877818","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=878064","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=878509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=878778","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=879291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=879308","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=879930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=880969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=881024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882651","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882807","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882813","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882837","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=882847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=883871","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=885391","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=886133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=886709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=886824","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=887230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=887741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=888689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889795","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=889985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=891279","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=891280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892532","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=892724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=894020","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=894288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=894345","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=894396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=894681","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=895049","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=895103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=903287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=905446","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=905564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=907232","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=907240","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=908745","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=912449","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=912697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915036","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915675","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=915950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=916582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=916728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=917522","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=917698","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=917719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=919672","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=921201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=923443","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=923614","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=923992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=924605","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=948282","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=950073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=953690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=956378","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=957051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=957611","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=971058","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0888.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2013-2144","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-2144","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2013-2144","description":"Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.","status":"published","published":"2013-07-03T18:00:00Z","modified":"2024-08-06T15:27:40.956Z","updated_at":"2026-11-02T14:34:56.19172Z"}],"euvd":[{"id":"EUVD-2013-2109","description":"Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.","status":"published","published":"2013-07-03T18:00:00Z","modified":"2024-08-06T15:27:40Z","updated_at":"2026-11-03T01:56:39.604617Z"}],"ghsa":[{"id":"GHSA-5q6m-qgpq-gv3p","title":"Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions...","description":"Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.","status":"published","published":"2022-05-17T05:07:49Z","modified":"2023-01-28T05:03:18Z","updated_at":"2026-11-02T14:43:57.015581Z"}],"nvd":[{"id":"CVE-2013-2144","description":"Red Hat Enterprise Virtualization Manager (RHEVM) before 3.2 does not properly check permissions for the target storage domain, which allows attackers to cause a denial of service (disk space consumption) by cloning a VM from a snapshot.","status":"published","published":"2013-07-03T18:55:01.06Z","modified":"2026-06-16T23:52:49.753Z","cvss":[{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:29.210317Z"}],"osv":[{"id":"RHSA-2013:0888","title":"Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.2 update","status":"published","published":"2024-09-13T07:36:50Z","modified":"2026-06-29T10:05:32Z","updated_at":"2026-11-02T15:53:01.993625Z"}]}}