CVE-2014-3573: redhat enterprise_virtualization_manager Improper Input Validation
Vulnerability summary
CVE-2014-3573 is a medium (CVSS 6.5) Improper Input Validation vulnerability in redhat enterprise_virtualization_manager. EPSS estimates a 1.76% chance of exploitation in the next 30 days, higher than 77.6% of scored vulnerabilities.
Timeline
- 18-10-2014PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The oVirt Engine backend module, as used in Red Hat Enterprise Virtualization Manager before 3.4.2, uses an "insecure DocumentBuilderFactory," which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML/RSDL document, related to an XML External Entity (XXE) issue.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
1.76%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.76% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat16 products
- enterprise_virtualization_manager≤ 3.4.1
- rhevm< 0:3.4.2-0.2.el6ev
- rhevm-backend< 0:3.4.2-0.2.el6ev
- rhevm-dbscripts< 0:3.4.2-0.2.el6ev
- rhevm-lib< 0:3.4.2-0.2.el6ev
1 vendor · 16 products
