CVE-2015-0236

Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 29 Jan 2015, 15:00
Last modified:06 Aug 2024, 04:03

Vulnerability Summary

Overall Risk (default)
low
14/100
CVSS Score
3.5 LOW
v2.0 (nvd)
EPSS Score
0.49% LOW
0% probability -0.16%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

29 Jan 2015, 15:00
Published
Vulnerability first disclosed
06 Aug 2024, 04:03
Last Modified
Vulnerability information updated

Description

libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the virDomainSnapshotGetXMLDesc interface or (2) image to the virDomainSaveImageGetXMLDesc interface.

CVSS Metrics

  • v2.0•LOW•Score: 3.5AV:N/AC:M/Au:S/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.49%• Percentile: 66%

Techniques & Countermeasures

  • CWE-200•Exposure of Sensitive Information to an Unauthorized Actor

    The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Affected Systems

  • canonical•ubuntu_linux

    12.04 | 14.04 | 15.04 | 15.10

  • mageia•mageia

    4.0

  • redhat•enterprise_linux_desktop

    7.0

  • redhat•enterprise_linux_hpc_node

    7.0

  • redhat•enterprise_linux_server

    7.0

  • redhat•enterprise_linux_workstation

    7.0

  • redhat•libvirt

    ≤ 1.2.11 | 1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.2.6 | 1.2.7 | 1.2.8 | 1.2.9 | 1.2.10

References (8)