← Vulnerability feed

Vulnerability record · CVE-2013-4401 · published 2 November 2013

CVE-2013-4401: Redhat libvirt permissions and access controls vulnerability

Redhat · Libvirt

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.

8.5 CVSS 2.0 High EPSS 1.7% · top 23.9% CWE-264 · Permissions and access controls
8.5CVSS 2.0 base score
1.7%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
16References
16 Jun 2026Last modified by NVD

Description

The virConnectDomainXMLToNative API function in libvirt 1.1.0 through 1.1.3 checks for the connect:read permission instead of the connect:write permission, which allows attackers to gain domain:write privileges and execute Qemu binaries via crafted XML. NOTE: some of these details are obtained from third party information.

AV:N/AC:M/Au:S/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=57687fd6bf7f6e1b3662c52f3f26c06ab19dc96c
http://secunia.com/advisories/55210 Vendor Advisory
http://secunia.com/advisories/60895
http://security.gentoo.org/glsa/glsa-201412-04.xml
http://wiki.libvirt.org/page/Maintenance_Releases
http://www.securitytracker.com/id/1029241
http://www.ubuntu.com/usn/USN-2026-1
https://bugzilla.redhat.com/show_bug.cgi?id=1015259 Patch
http://libvirt.org/git/?p=libvirt.git%3Ba=commit%3Bh=57687fd6bf7f6e1b3662c52f3f26c06ab19dc96c
http://secunia.com/advisories/55210 Vendor Advisory
http://secunia.com/advisories/60895
http://security.gentoo.org/glsa/glsa-201412-04.xml
http://wiki.libvirt.org/page/Maintenance_Releases
http://www.securitytracker.com/id/1029241
http://www.ubuntu.com/usn/USN-2026-1
https://bugzilla.redhat.com/show_bug.cgi?id=1015259 Patch

Track CVE-2013-4401 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2016-5008Redhat libvirt improper access control vulnerabilitylibvirt before 2.0.0 improperly disables password checking when the password on a VNC server is set to an empty string, which allows remote attackers…EPSS 3.6%8.8CVE-2020-14339Redhat libvirt vulnerabilityA flaw was found in libvirt, where it leaked a file descriptor for `/dev/mapper/control` into the QEMU process. This file descriptor allows for privi…EPSS 0.42%8.8CVE-2019-10132Redhat libvirt incorrect permission assignment vulnerabilityA vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configurati…EPSS 1.4%8.1CVE-2017-1000256Redhat libvirt improper certificate validation vulnerabilitylibvirt version 2.3.0 and later is vulnerable to a bad default configuration of "verify-peer=no" passed to QEMU by libvirt resulting in a failure to …EPSS 1.7%7.8CVE-2019-10166Redhat libvirt improper access control vulnerabilityIt was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDe…EPSS 0.47%7.8CVE-2019-10167Redhat libvirt execution with unnecessary privileges vulnerabilityThe virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify …EPSS 0.52%7.8CVE-2019-10168Redhat libvirt execution with unnecessary privileges vulnerabilityThe virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emula…EPSS 0.55%7.8CVE-2019-10161Redhat libvirt improper access control vulnerabilityIt was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specif…EPSS 0.52%

Source: NIST National Vulnerability Database (record CVE-2013-4401), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.