{"id":"CVE-2014-0152","aliases":["EUVD-2014-0211","GHSA-73j8-g9r9-3463","RHSA-2014:0506"],"status":"published","title":"Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows...","description":"Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.","severity":{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.01757,"percentile":0.78092,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2014-09-08T14:00:00Z","modified":"2026-06-29T10:06:44Z","affected":[{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-allinone","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-ovirt-engine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-setup-plugin-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-userportal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhev_manager:3","package":"rhevm-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.4.0-0.21.el6ev"}]}],"bundled":2}],"products":[{"vendor":"ovirt","product":"ovirt"},{"vendor":"redhat","product":"ovirt-engine"}],"references":[{"url":"http://gerrit.ovirt.org/#/c/25959/","tags":["x_refsource_CONFIRM","x_transferred","Patch"]},{"url":"http://www.ovirt.org/Security_advisories","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0152","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2014:0506","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1081860","tags":["report"]},{"url":"http://gerrit.ovirt.org/#/c/25959"},{"url":"https://github.com/advisories/GHSA-73j8-g9r9-3463"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.4/html-single/Technical_Notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=741111","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=818051","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=828080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=856272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=858166","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=867794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=877747","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=948653","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=953492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=955429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=957939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=962180","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=969641","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=970488","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=974076","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=977461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=981420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=983088","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=999713","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1015185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1016844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1018847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1020408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1025295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1026389","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1026842","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1026857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1026868","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1026980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1027697","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1029441","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1030122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1032679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1036885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1038980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1044089","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1044091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1045139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1046625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1047629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1048356","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1049080","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1049272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1049627","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1051297","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052231","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1052318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1053890","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1054410","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1055710","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1056064","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1056307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1056743","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1056803","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057358","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057360","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057369","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057561","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057988","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057996","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1057998","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1059400","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1060575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1060636","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1060705","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1061634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1062438","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1063782","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064068","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064312","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064880","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1064907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066103","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1066884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1067551","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1068717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1068763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1069096","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1070667","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1070704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1070835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1072059","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1072282","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1073479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1073669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1075682","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076131","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1076246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1077779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1081875","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1082800","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1085529","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1089777","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1090660","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1091391","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0506.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0152","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-0153","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-0153","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0153","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2014-0152","description":"Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.","status":"published","published":"2014-09-08T14:00:00Z","modified":"2024-08-06T09:05:39.205Z","updated_at":"2026-11-02T14:33:47.330011Z"}],"euvd":[{"id":"EUVD-2014-0211","description":"Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.","status":"published","published":"2014-09-08T14:00:00Z","modified":"2024-08-06T09:05:39Z","updated_at":"2026-11-03T01:57:22.468358Z"}],"ghsa":[{"id":"GHSA-73j8-g9r9-3463","title":"Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows...","description":"Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.","status":"published","published":"2022-05-13T01:30:41Z","modified":"2025-04-12T12:38:16Z","updated_at":"2026-11-02T15:01:18.41255Z"}],"nvd":[{"id":"CVE-2014-0152","description":"Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unspecified vectors.","status":"published","published":"2014-09-08T14:55:02.403Z","modified":"2026-06-17T00:02:23.65Z","cvss":[{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:02:55.540337Z"}],"osv":[{"id":"RHSA-2014:0506","title":"Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.4.0 update","status":"published","published":"2024-09-13T08:52:45Z","modified":"2026-06-29T10:06:44Z","updated_at":"2026-11-02T15:53:02.532052Z"}]}}