CVE-2016-6338
First published: Tue Aug 23 2016(Updated: )
Greg Sheremeta of Red Hat reports: We've found a scenario a webadmin session won't timeout and force a logout. We had a CVE on this before. To duplicate: navigate to the Data Centers tab. Select a data center. Switch to another browser tab and wait longer than the engine timeout period [1] to switch back to webadmin. You won't be logged out -- even though you should be. Basically, idling while certain things in the UI are selected (a data center, a cluster -- maybe others?) will prevent the session from timing out. We see three gluster queries that are repeating and keeping the session open. Alexander is looking for others. We know the fix -- just have to find them all.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Enterprise Virtualization | =4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2016-6338?
CVE-2016-6338 has been assigned a severity rating that indicates potential risks due to session management failure.
How do I fix CVE-2016-6338?
To fix CVE-2016-6338, update your Red Hat Enterprise Virtualization to the latest security patch provided by Red Hat.
What software is affected by CVE-2016-6338?
CVE-2016-6338 affects Red Hat Enterprise Virtualization version 4.0.
Can CVE-2016-6338 lead to unauthorized access?
Yes, CVE-2016-6338 can potentially allow unauthorized access if an admin session does not timeout properly.
What is the potential impact of exploiting CVE-2016-6338?
Exploitation of CVE-2016-6338 could result in prolonged access to webadmin sessions, posing security risks.
- agent/type
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2016-6338
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/author
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/description
- agent/event
- agent/source
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/redhat
- canonical/red hat enterprise virtualization
- version/red hat enterprise virtualization/4.0