ovirt-engine
En bref
- Source
- NVD
- EPSS
- EPSS 1.85 % · centile 79 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer visible. The highest threat from this vulnerability is on confidentiality.
Faiblesses (CWE)
- CWE-451 — Présentation trompeuse d'informations critiques dans l'interface
- CWE-601 — Redirection d'URL vers un site non fiable (redirection ouverte)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.3 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | LOW 2.6 | AV:N/AC:H/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2020-3189
- GCVE · GCVE-0-2020-10775
Configurations affectées (CPE NVD)
cpe:2.3:a:oracle:virtualization:4.0:*:*:*:*:*:*:*cpe:2.3:a:redhat:ovirt-engine:*:*:*:*:*:*:*:*≤ 4.4
Produits affectés
| Produit | Versions |
|---|---|
| ovirt-engine | affected ovirt-engine versions before 4.4.2 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |