4.9Media
CVE-2024-7259Ovirt-engine: potential exposure of cleartext provider passwords via web ui
Descripción
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
Debilidad (CWE):
CWE-312
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| ovirt | ovirt-engine | < 4.5.7 | |
| Red Hat | Red Hat Virtualization 4 | all versions | |
| — | ovirt-engine | < 4.5.7 |
Referencias y parches
- https://access.redhat.com/security/cve/CVE-2024-7259 vdb-entryVendor Advisory
- RHBZ#2314229 issue-trackingIssue TrackingVendor Advisory
- https://github.com/oVirt/ovirt-engine/commit/4ad930699509a060490e07ed8620cccbb3a24897
- https://github.com/oVirt/ovirt-engine/pull/969
- https://github.com/oVirt/ovirt-engine/pull/970
Coincidencias CPE (NVD) (1)
cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:*< 4.5.7