CVE-2014-7823

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2014-11-13 · updated 2026-06-17
Weakness: CWE-255

Description

The virDomainGetXMLDesc API in Libvirt before 1.2.11 allows remote read-only users to obtain the VNC password by using the VIR_DOMAIN_XML_MIGRATABLE flag, which triggers the use of the VIR_DOMAIN_XML_SECURE flag.

Affected products

libvirt: through 1.2.10; 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.4, 1.2.5 (+4)

References

http://lists.opensuse.org/opensuse-updates/2014-11/msg00083.html
http://secunia.com/advisories/60010
http://secunia.com/advisories/60895
http://secunia.com/advisories/62058
http://secunia.com/advisories/62303
http://security.gentoo.org/glsa/glsa-201412-04.xml
http://security.libvirt.org/2014/0007.html
http://www.ubuntu.com/usn/USN-2404-1
http://lists.opensuse.org/opensuse-updates/2014-11/msg00083.html
http://secunia.com/advisories/60010
http://secunia.com/advisories/60895
http://secunia.com/advisories/62058

Get alerted when CVE-2014-7823 or the next vulnerability affects your stack