Skip to main content

Libvirt CVE-2014-7823

MEDIUM
Credentials Management Errors (CWE-255)
2014-11-13 secalert@redhat.com
Authentication Bypass Libvirt
5.0
CVSS 2.0 · NVD
Share

Severity by source

NVD PRIMARY
5.0 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Confidentiality
P
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Nov 13, 2014 - 21:32 cve.org
MEDIUM 5.0

DescriptionCVE.org

The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.

AnalysisAI

The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-255. The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag. Affected products include: Redhat Libvirt. Version information: before 1.2.11.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Libvirt

View all
CVE-2013-2218 MEDIUM POC
5.0 Sep 30

Double free vulnerability in the virConnectListAllInterfaces method in interface/interface_backend_netcf.c in libvirt 1.
CVE-2013-0170 MEDIUM
6.8 Feb 08

Use-after-free vulnerability in the virNetMessageFree function in rpc/virnetserverclient.c in libvirt 1.0.x before 1.0.2
CVE-2020-10703 MEDIUM POC
6.5 Jun 02

A NULL pointer dereference was found in the libvirt API responsible introduced in upstream version 3.10.0, and fixed in

CVE-2019-3840 MEDIUM POC
6.3 Mar 27

A NULL pointer dereference flaw was discovered in libvirt before version 5.0.0 in the way it gets interface information

CVE-2016-5008 CRITICAL
9.8 Jul 13

libvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string,

CVE-2019-3886 MEDIUM POC
5.4 Apr 04

An incorrect permissions check was discovered in libvirt 4.8.0 and above. Rated medium severity (CVSS 5.4), this vulnera
CVE-2013-4153 MEDIUM POC
5.0 Sep 30

Double free vulnerability in the qemuAgentGetVCPUs function in qemu/qemu_agent.c in libvirt 1.0.6 through 1.1.0 allows r
CVE-2013-5651 MEDIUM POC
5.0 Sep 30

The virBitmapParse function in util/virbitmap.c in libvirt before 1.1.2 allows context-dependent attackers to cause a de
CVE-2020-14339 HIGH
8.8 Dec 03

A flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. Rated hi
CVE-2019-10132 HIGH
8.8 May 22

A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. Rat
CVE-2013-4401 HIGH
8.5 Nov 02

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission inste
CVE-2013-4154 MEDIUM POC
4.3 Sep 30

The qemuAgentCommand function in libvirt before 1.1.1, when a guest agent is not configured, allows remote attackers to

Same weakness CWE-255 – Credentials Management Errors

View all
CVE-2014-1812 HIGH POC
8.8
CVE-2016-7456 CRITICAL POC
9.8
CVE-2012-1493 HIGH POC
7.8
CVE-2012-4933 HIGH POC
7.8
CVE-2013-4786 HIGH POC
7.5
CVE-2013-3502 MEDIUM POC
6.5
CVE-2015-7251 CRITICAL POC
9.8
CVE-2013-6884 CRITICAL POC
10.0

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Share

CVE-2014-7823 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy