CVE-2020-14333: XSS
A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other confidential information, or impersonate them within the application's context.
Other sources
A flaw was found in the web interface of ovirt-engine 4.4.2 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other confidential information, or impersonate them within the application's context.
Ovirt Engine's web interface in ovirt 4.4.2 and earlier does not filter user controllable parameters completely, which may result in a reflected cross site scripting attack.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-14333?
CVE-2020-14333 is a vulnerability found in the web interface of ovirt-engine 4.4.2 and earlier, which allows for a reflected cross-site scripting attack.
What is the severity of CVE-2020-14333?
The severity of CVE-2020-14333 is medium with a CVSS score of 6.1.
How does CVE-2020-14333 impact ovirt-engine?
CVE-2020-14333 allows an attacker to perform a phishing attack, steal user's cookies, or execute other malicious actions through the web interface of ovirt-engine.
Which versions of ovirt-engine are affected by CVE-2020-14333?
ovirt-engine versions up to and including 4.4.0 are affected by CVE-2020-14333.
How can I fix the CVE-2020-14333 vulnerability?
To fix the CVE-2020-14333 vulnerability, users should upgrade ovirt-engine to version 4.4.2 or later.