LiveActive security incident?Get immediate response
CVE Record

CVE-2015-1780: oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center

oVirt users with MANIPULATE_STORAGE_DOMAIN permissions can attach a storage domain to any data-center

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2015-1780 is an oVirt authorization issue. A user who already has MANIPULATE_STORAGE_DOMAIN permission may attach a storage domain to any data center, not just the intended one. That could weaken operational separation around virtualization storage, but the sources do not provide severity scoring or confirmed impact details.

Executive priority

Treat this as a targeted legacy-platform authorization risk. It is not supported by evidence of active exploitation, but it may matter where older oVirt environments still manage sensitive virtualization storage or where delegated administration is broad.

Technical view

The reported flaw affects oVirt through 2015-03-06. It concerns improper authorization around storage-domain attachment: possession of MANIPULATE_STORAGE_DOMAIN permission could allow attachment to any data-center. The source bundle does not provide CVSS, CWE classification, patch version, or detailed affected component names.

Likely exposure

Exposure is most likely in older oVirt environments from or before 2015-03-06 where MANIPULATE_STORAGE_DOMAIN is assigned beyond tightly trusted administrators. The sources do not indicate internet exposure, default role mappings, or whether supported modern oVirt versions remain affected.

Exploitation context

No active exploitation is stated in the provided sources, and the CVE is not listed as KEV in the bundle. Exploitation would require an authenticated oVirt user with the named storage-domain permission; the available evidence does not describe public exploit activity or weaponized tooling.

Researcher notes

Evidence is sparse. The core issue is clear from the CVE description, but scoring, exact code path, fixed release, and exploitability constraints are not present in the provided bundle. Avoid assuming unauthenticated access or current product impact without vendor confirmation.

Mitigation direction

  • Review Red Hat and oVirt guidance for the fixed or recommended version.
  • Limit MANIPULATE_STORAGE_DOMAIN permission to trusted virtualization administrators.
  • Audit custom roles that include storage-domain manipulation rights.
  • Review data-center storage-domain attachments for unexpected relationships.
  • Plan upgrade or compensating access controls if legacy oVirt remains in use.

Validation and detection

  • Inventory oVirt deployments and identify versions through 2015-03-06.
  • List users and roles with MANIPULATE_STORAGE_DOMAIN permission.
  • Verify whether storage domains are attached only to intended data centers.
  • Check Red Hat CVE and Bugzilla entries for remediation status.
  • Document any legacy instances requiring compensating controls.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2015-1780 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
oVirtoVirtthrough 2015-03-06Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.