CVE-2018-1075 MEDIUM

CVE-2018-1075

Vendor [Unknown]

Product ovirt-engine

Weakness CWE-532 · Sensitive info in logs

Published June 12, 2018

Last update August 5, 2024

View on NVD All CVEs

CVSS base score

5.0/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction Required

Confidentiality High

Integrity None

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.

Key dates

02Disclosure timeline

June 12, 2018 CVE published

August 5, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2018-1075 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/532.html

Related vulnerabilities

04Related CVE

CVE-2023-39348 Improper log output when using GitHub Status Notifications in spinnaker CVE-2025-0273 HCL DevOps Deploy / HCL Launch is susceptible to Insertion of Sensitive Information into Log File vulnerability CVE-2025-55285 @backstage/plugin-scaffolder-backend Template Secret Leakage in Logs in Scaffolder When Using `fetch:template` CVE-2024-2302 Easy Digital Downloads – Sell Digital Files & Subscriptions (eCommerce Store + Payments Made Easy) <= 3.2.9 - Sensitive Information Exposure CVE-2025-13321 Mattermost Desktop App logging sensitive information and fails to clear data on server deletion