4.9
Medium
CVE-2024-7259 Ovirt-engine: potential exposure of cleartext provider passwords via web ui
Description
A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.
CVSS 3.1 detail
Vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:NExploitable remotely over the network, with an administrator account and without any user action; an attacker can seriously compromise confidentiality, integrity or availability.
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Red Hat Virtualization 4 | Versions not published |
References
- access.redhat.com access.redhat.com
- RHBZ#2314229 bugzilla.redhat.com
- github.com github.com
- github.com github.com
- github.com github.com
Timeline
- Published
- Last modified
Other CVEs of Red Hat Virtualization 4
The 5 CVEs of Red Hat Virtualization 4 →
CVE-2023-50781
A flaw was found in m2crypto
7.5
High
CVE-2023-6200
A race condition was found in the Linux Kernel
7.5
High
CVE-2023-5366
A flaw was found in Open vSwitch that allows ICMPv6 Neighbor Advertisement packets between virtual machines to bypass…
7.1
High
CVE-2023-4194
A flaw was found in the Linux kernel's TUN/TAP functionality
5.5
Medium