Ovirt-engine: potential exposure of cleartext provider passwords via web ui
Published Sep 26, 2024
4.9
MEDIUMCVSS 3.1
EPSS 0.26%
Description
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
Affected products
Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).
| Vendor | Product | Default status | Versions |
|---|---|---|---|
| Red Hat | Red Hat Virtualization 4 | affected |
- < 4.5.7
Running on/with
- 4.0
No data.
Red Hat Virtualization 4
ovirt-engine
Will not fix
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Virtualization 4 | ovirt-engine | Will not fix | n/a |
No package ranges for this CVE.
Remediation
Vendor solution
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
References (5)
- https://access.redhat.com/security/cve/CVE-2024-7259 vdb-entryx_refsource_REDHATVendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2314229 issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48206 Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-7259
- https://www.cve.org/CVERecord?id=CVE-2024-7259
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2024-7259 | vdb-entryx_refsource_REDHATVendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2314229 | issue-trackingx_refsource_REDHATIssue TrackingVendor Advisory | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-48206 | Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2024-7259 | ||
| https://www.cve.org/CVERecord?id=CVE-2024-7259 |
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
GitHub
No data