The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.
CVSS Details
- CVSS 3.1 Base Score: 4.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libvirt-lock-sanlockUpgrade libvirt-pythonUpgrade libvirtUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-develUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-config-networkUpgrade libvirt-clientUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemonUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-docsUpgrade libvirt-login-shellUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage | Dec 1, 2016 | Nov 13, 2014 |
| Debian | — | Upgrade libvirt | Jul 30, 2024 | Nov 13, 2014 |
| Gentoo Linux | — | Upgrade app-emulation/libvirt. | Oct 30, 2017 | Nov 13, 2014 |
| Oracle_linux | — | Upgrade libvirt-daemon-driver-nodedevUpgrade libvirt-pythonUpgrade libvirtUpgrade libvirt-daemonUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-docsUpgrade libvirt-daemon-driver-secretUpgrade libvirt-login-shellUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-clientUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-devel | Oct 16, 2024 | Nov 13, 2014 |
| Suse | — | Upgrade libvirt-daemon-driver-networkUpgrade libvirt-daemon-xenUpgrade libvirt-daemon-config-networkUpgrade libvirt-nssUpgrade kvmUpgrade libvirt-client-32bitUpgrade libvirt-daemon-driver-nodedevUpgrade libvirtUpgrade libvirt-daemonUpgrade libvirt-lock-sanlockUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-secretUpgrade libvirt-clientUpgrade libvirt-pythonUpgrade libvirt-daemon-driver-lxcUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-libxlUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-qemuUpgrade libvirt-daemon-lxcUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-hooksUpgrade libvirt-devel-32bitUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-libsUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-docUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-devel | Dec 18, 2015 | Nov 13, 2014 |
| Ubuntu | — | Upgrade libvirt0Upgrade libvirt-bin | Nov 8, 2024 | Nov 13, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub