CVE-2016-6338: Red Hat Enterprise Virtualization

Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days.

ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries.

Affected products

• Red Hat Enterprise Virtualization: version 4.0 only

Published 2017-04-20. Last modified 2026-06-17.