CVE-2014-0184 - CFME: root password is written to evm.log when entered during VM provisioning

Back Back to CVE browser

MEDIUM

CFME: root password is written to evm.log when entered during VM provisioning

Published Jul 7, 2014

4.9

MEDIUM

CVSS 2.0

EPSS 0.40%

Description

Red Hat CloudForms 3.0 Management Engine (CFME) before 5.2.4.2 logs the root password when deploying a VM, which allows local users to obtain sensitive information by reading the evm.log file.

Affected products

CloudForms Management Engine 5.x

cfme-0:5.2.4.2-1.el6cf

Fixed · RHSA-2014:0816
CloudForms Management Engine 5.x

ruby193-rubygem-actionpack-1:3.2.13-8.el6cf

Fixed · RHSA-2014:0816

Product	Package	State	Advisory
CloudForms Management Engine 5.x	cfme-0:5.2.4.2-1.el6cf	Fixed	RHSA-2014:0816
CloudForms Management Engine 5.x	ruby193-rubygem-actionpack-1:3.2.13-8.el6cf	Fixed	RHSA-2014:0816

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-255

CWE-522

Insufficiently Protected Credentials

References (6)

http://rhn.redhat.com/errata/RHSA-2014-0816.html
vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/security/cve/CVE-2014-0184
Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1089131
Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-0236
Advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-0184
https://www.cve.org/CVERecord?id=CVE-2014-0184

Link	Providers	Tags
http://rhn.redhat.com/errata/RHSA-2014-0816.html		vendor-advisoryx_refsource_REDHATVendor Advisory
https://access.redhat.com/security/cve/CVE-2014-0184		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1089131		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2014-0236		Advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-0184
https://www.cve.org/CVERecord?id=CVE-2014-0184