CVE-2024-7259mediumCWE-312

CVE-2024-7259: falha de média gravidade em ovirt-engine

Ovirt-engine: potential exposure of cleartext provider passwords via web ui

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ovirt-engine+ Monitorar Red Hat Virtualization

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 4.9epss 0.3%
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
ovirt-engineRed Hat · Red Hat Virtualization 4
CVEs relacionadas — ovirt-engine

No mesmo produto, das mais perigosas para as menos.

CVE-2023-6200HIGHKernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerabilityEPSS 2.0%CVE-2023-50781HIGHM2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657EPSS 1.1%CVE-2024-0822HIGHOvirt: authentication bypassEPSS 0.7%CVE-2023-5366HIGHOpenvswitch don't match packets on nd_target fieldEPSS 0.4%CVE-2023-4194MEDIUMKernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuidEPSS 0.3%