CVE-2016-3113: XSS
First published: Wed Apr 13 2016(Updated: )
An XSS vulnerability was found in ovirt-engine when submitting configuration file used to build up the VNC/SPICE-Connection. The file is automatically generated without any user input on the client side and uploaded to the server, which immediately reflects that upload. Legitimate HTTP Request looks aas following: POST /ovirt-engine/services/attachment/console.vv contenttype=application%2Fx-virt-viewer%3B+charset%3DUTF-8&content=[...configuration file...]&encodingtype=plain Web application accepts the POST-Parameter contenttype, that sets the Content-Type of the HTTP-Response of the reflected upload. When setting the contenttype to text/html, it allows to inject malicious JavaScript code to be reflected on the page. The attacker could send RPC-Requests via XHR with the privileges of the victim. If the victim is logged in, the attacker can inject a JavaScript code that sends a RPC-Request to start, stop or manipulate a specific VM.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Redhat Ovirt-engine |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/references
- agent/description
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-3113
- agent/weakness
- agent/tags
- agent/trending
- vendor/redhat
- canonical/redhat ovirt-engine