CVE-2018-1074

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.

Score

CVSS 3.0 7.7 High

Status

Modified - secalert@redhat.com

Published

2018-04-26

Last modified

2024-08-05

Weaknesses

CWE-200, CWE-522

Affected products

• Ovirt (Ovirt)
• Enterprise Virtualization (Redhat)
• Ovirt-engine (Unspecified)

References

• https://access.redhat.com/errata/RHBA-2018:1219
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1074