4.9Orta
CVE-2024-7259Ovirt-engine: potential exposure of cleartext provider passwords via web ui
Açıklama
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
Zayıflık türü (CWE):
CWE-312
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| ovirt | ovirt-engine | < 4.5.7 | |
| Red Hat | Red Hat Virtualization 4 | all versions | |
| — | ovirt-engine | < 4.5.7 |
Kaynaklar ve yamalar
- https://access.redhat.com/security/cve/CVE-2024-7259 vdb-entryVendor Advisory
- RHBZ#2314229 issue-trackingIssue TrackingVendor Advisory
- https://github.com/oVirt/ovirt-engine/commit/4ad930699509a060490e07ed8620cccbb3a24897
- https://github.com/oVirt/ovirt-engine/pull/969
- https://github.com/oVirt/ovirt-engine/pull/970
CPE eşleşmeleri (NVD) (1)
cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:*< 4.5.7