CVE-2020-14333
ovirt-engine: Reflected cross site scripting vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other confidential information, or impersonate them within the application's context.
Se detectó un fallo en la interfaz web de Ovirt Engine en ovirt versiones 4.4 y anteriores, donde no filtraba los parámetros controlables por el usuario por completo, resultando en un ataque de tipo cross-site scripting reflejado. Este fallo le permite a un atacante aprovechar un ataque de phishing, robar las cookies de un usuario desprevenido u otra información confidencial, o hacerse pasar por ellos dentro del contexto de la aplicación.
A flaw was found in the web interface of ovirt-engine 4.4.2 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other confidential information, or impersonate them within the application's context.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-06-17 CVE Reserved
- 2020-08-18 CVE Published
- 2023-05-04 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (3)
URL | Tag | Source |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|---|---|
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14333 | 2023-02-12 | |
https://access.redhat.com/security/cve/CVE-2020-14333 | 2020-09-23 | |
https://bugzilla.redhat.com/show_bug.cgi?id=1858184 | 2020-09-23 |
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Ovirt Search vendor "Ovirt" | Ovirt-engine Search vendor "Ovirt" for product "Ovirt-engine" | <= 4.4.0 Search vendor "Ovirt" for product "Ovirt-engine" and version " <= 4.4.0" | - |
Affected
|