CVE-2018-1074 HIGH

CVE-2018-1074

Vendor Unspecified
Product ovirt-engine
Weakness CWE-200 · Info exposure
Published April 26, 2018
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

7.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.

Key dates

02Disclosure timeline

April 26, 2018 CVE published
August 5, 2024 Record updated