Medium severity · published Jul 11, 2019
CVE-2019-10194
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OV
Ovirt · Ovirt
All versions, or not specified · source: NVD
VM
Virtualization Manager · Redhat
4.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-10194
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-10194
Broken Link
http://www.securityfocus.com/bid/109140
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:2499
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10194
More from Ovirt
9.8
CVE-2018-1072
ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files
8.1
CVE-2019-3879
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be…
7.8
CVE-2018-1075
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning
7.5
CVE-2014-7851
oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session…
7.2
CVE-2018-1074
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to…