4.9Mittel
CVE-2024-7259Ovirt-engine: potential exposure of cleartext provider passwords via web ui
Beschreibung
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
Schwachstellentyp (CWE):
CWE-312
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
| Hersteller | Produkt | Versionen | |
|---|---|---|---|
| ovirt | ovirt-engine | < 4.5.7 | |
| Red Hat | Red Hat Virtualization 4 | all versions | |
| — | ovirt-engine | < 4.5.7 |
Referenzen und Patches
- https://access.redhat.com/security/cve/CVE-2024-7259 vdb-entryVendor Advisory
- RHBZ#2314229 issue-trackingIssue TrackingVendor Advisory
- https://github.com/oVirt/ovirt-engine/commit/4ad930699509a060490e07ed8620cccbb3a24897
- https://github.com/oVirt/ovirt-engine/pull/969
- https://github.com/oVirt/ovirt-engine/pull/970
CPE-Treffer (NVD) (1)
cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:*< 4.5.7