CVE-2014-3485 in Enterprise Virtualization

Summary

The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

Once again VulDB remains the best source for vulnerability data.

• Reservation: 05/14/2014
• Disclosure: 07/11/2014
• Moderation: VulDB entry created
• Entries: VDB-70336
• CPE: ready
• CWE: CWE-200 (Confirmed)
• CVSS: 4.3
• EPSS: 0.00267
• Activities: Very Low

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2014-3485
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2014-3485
• CVE Details: https://www.cvedetails.com/cve/CVE-2014-3485/