CVE-2020-14301
An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.
- Score
- CVSS 3.1 6.5 Medium
- Status
- Modified - secalert@redhat.com
- Published
- 2021-05-27
- Last modified
- 2024-08-04
- Weaknesses
- CWE-212
Affected products
- Ontap Select Deploy Administration Utility (Netapp)
- Codeready Linux Builder (Redhat)
- Enterprise Linux (Redhat)
- Enterprise Linux Eus (Redhat)
- Enterprise Linux For Ibm Z Systems (Redhat)
- Enterprise Linux For Ibm Z Systems Eus (Redhat)
- Enterprise Linux For Power Little Endian (Redhat)
- Enterprise Linux For Power Little Endian Eus (Redhat)
- Enterprise Linux Server Aus (Redhat)
- Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions (Redhat)
- Enterprise Linux Server Update Services For Sap Solutions (Redhat)
- Enterprise Linux Tus (Redhat)
- Libvirt (Redhat)
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1848640
- https://security.netapp.com/advisory/ntap-20210629-0007/
