CVE-2020-14301

moderate-risk

Published 2021-05-27

An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML dump of the guest domain. This flaw allows an attacker to access potentially sensitive information in the domain configuration via the `dumpxml` command.

Do I need to act?

0.49% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (13)

Libvirt

Enterprise Linux

Enterprise Linux Eus

Enterprise Linux For Ibm Z Systems

Enterprise Linux For Ibm Z Systems Eus

Enterprise Linux For Power Little Endian

Enterprise Linux For Power Little Endian Eus

Enterprise Linux Server Aus

Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions

Enterprise Linux Server Update Services For Sap Solutions

Enterprise Linux Tus

Ontap Select Deploy Administration Utility

Codeready Linux Builder

Affected Vendors

Redhat Netapp

References (4)

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1848640

Third Party Advisory https://security.netapp.com/advisory/ntap-20210629-0007/

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1848640

Third Party Advisory https://security.netapp.com/advisory/ntap-20210629-0007/

/ 100

moderate-risk

Severity 24/34 · High

Exploitability 2/34 · Minimal

Exposure 17/34 · Moderate