CVE-2018-1073

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.

Score

CVSS 3.1 5.3 Medium

Status

Modified - secalert@redhat.com

Published

2018-06-19

Last modified

2024-08-05

Weaknesses

CWE-200, CWE-209

Affected products

• Ovirt-engine (Ovirt)
• Virtualization (Redhat)
• Virtualization Host (Redhat)
• Ovirt-engine (Unknown)

References

• http://www.securityfocus.com/bid/104189
• https://access.redhat.com/errata/RHSA-2018:1525
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1073