4.9Medium
CVE-2024-7259Ovirt-engine: potential exposure of cleartext provider passwords via web ui
Description
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
Weakness (CWE):
CWE-312
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| ovirt | ovirt-engine | < 4.5.7 | |
| Red Hat | Red Hat Virtualization 4 | all versions | |
| — | ovirt-engine | < 4.5.7 |
References and patches
- https://access.redhat.com/security/cve/CVE-2024-7259 vdb-entryVendor Advisory
- RHBZ#2314229 issue-trackingIssue TrackingVendor Advisory
- https://github.com/oVirt/ovirt-engine/commit/4ad930699509a060490e07ed8620cccbb3a24897
- https://github.com/oVirt/ovirt-engine/pull/969
- https://github.com/oVirt/ovirt-engine/pull/970
CPE matches (NVD) (1)
cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:*< 4.5.7