Unscored severity · published Mar 12, 2013
CVE-2012-6115
The domain management tool (rhevm-manage-domains) in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier, when the validate action is enabled, logs the…
–
CVSS
0.4%
EPSS
No
On KEV
Description
The domain management tool (rhevm-manage-domains) in Red Hat Enterprise Virtualization Manager (RHEV-M) 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information by reading this file.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EV
Enterprise Virtualization Manager · Redhat
through 3.1; 2.1; 2.2; 2.2.3; 3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2012-6115
CVE.org
https://www.cve.org/CVERecord?id=CVE-2012-6115
gerrit.ovirt.org
http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commit%3Bh=e8c72daec4efa8be0fcd8ea55c41e855ddd8eedf
rhn.redhat.com
http://rhn.redhat.com/errata/RHSA-2013-0211.html
www.securityfocus.com
http://www.securityfocus.com/bid/57749
www.securitytracker.com
http://www.securitytracker.com/id/1028076
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=893355
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/81833
More from Enterprise Virtualization Manager
9.8
CVE-2018-1072
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files
9.1
CVE-2015-7544
redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager (aka RHEV Manager) before 3.6 allows remote authenticated users with the SuperUser role on any Entity to…
7.8
CVE-2018-8897
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) was mishandled in the development of some or all…
5.9
CVE-2015-5293
Red Hat Enterprise Virtualization Manager 3.6 and earlier gives valid SLAAC IPv6 addresses to interfaces when "boot protocol" is set to None, which might allow remote attackers to…
3.1
CVE-2009-3552
In RHEV-M VDC 2.2.0, it was found that the SSL certificate was not verified when using the client-side Red Hat Enterprise Virtualization Manager interface (a Windows Presentation…