CVE-2016-3113: XSS
An XSS vulnerability was found in ovirt-engine when submitting configuration file used to build up the VNC/SPICE-Connection. The file is automatically generated without any user input on the client side and uploaded to the server, which immediately reflects that upload. Legitimate HTTP Request looks aas following:
POST /ovirt-engine/services/attachment/console.vv
contenttype=application%2Fx-virt-viewer%3B+charset%3DUTF-8&content=[...configuration file...]&encodingtype=plain
Web application accepts the POST-Parameter contenttype, that sets the Content-Type of the HTTP-Response of the reflected upload. When setting the contenttype to text/html, it allows to inject malicious JavaScript code to be reflected on the page. The attacker could send RPC-Requests via XHR with the privileges of the victim. If the victim is logged in, the attacker can inject a JavaScript code that sends a RPC-Request to start, stop or manipulate a specific VM.
Other sources
Cross-site scripting (XSS) vulnerability in ovirt-engine allows remote attackers to inject arbitrary web script or HTML.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3113?
CVE-2016-3113 is considered a moderate severity vulnerability due to its potential for XSS attacks.
How can I fix CVE-2016-3113?
To fix CVE-2016-3113, update to the latest version of Red Hat oVirt Engine where the vulnerability is patched.
What type of vulnerability is CVE-2016-3113?
CVE-2016-3113 is an XSS (Cross-Site Scripting) vulnerability affecting oVirt Engine.
What systems are affected by CVE-2016-3113?
CVE-2016-3113 affects versions of Red Hat oVirt Engine.
Are there exploit scenarios for CVE-2016-3113?
Exploiting CVE-2016-3113 could allow attackers to execute arbitrary scripts in the context of the user's browser.