ByteOS Network

Vulnerability Details :

CVE-2017-15113

Assigner-redhat

Assigner Org ID-53f830b8-0a3f-465b-8143-3b8a9948e749

Published At-27 Jul, 2018 | 16:00

Updated At-05 Aug, 2024 | 19:50

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:redhat

Assigner Org ID:53f830b8-0a3f-465b-8143-3b8a9948e749

Published At:27 Jul, 2018 | 16:00

Updated At:05 Aug, 2024 | 19:50

▼CVE Numbering Authority (CNA)

Affected Products

Vendor

Red Hat, Inc.

Product

ovirt-engine

Versions

Affected

4.1.7.6

Problem Types

Type	CWE ID	Description
CWE	CWE-212	CWE-212

Type: CWE

CWE ID: CWE-212

Description: CWE-212

Metrics

Version	Base score	Base severity	Vector
3.0	7.2	HIGH	CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Version: 3.0

Base score: 7.2

Base severity: HIGH

Vector:

CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

References

Hyperlink	Resource
https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commitdiff%3Bh=f4a5d0cc772127dbfe40789e26c4633ceea07d14%3Bhp=e6e8704ac9eb115624ff66e2965877d8e63a45f4	x_refsource_CONFIRM
http://www.securityfocus.com/bid/101933	vdb-entry x_refsource_BID
https://access.redhat.com/errata/RHEA-2017:3138	vendor-advisory x_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113	x_refsource_CONFIRM

Hyperlink: https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commitdiff%3Bh=f4a5d0cc772127dbfe40789e26c4633ceea07d14%3Bhp=e6e8704ac9eb115624ff66e2965877d8e63a45f4

Resource:

x_refsource_CONFIRM

Hyperlink: http://www.securityfocus.com/bid/101933

Resource:

vdb-entry

x_refsource_BID

Hyperlink: https://access.redhat.com/errata/RHEA-2017:3138

Resource:

vendor-advisory

x_refsource_REDHAT

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113

Resource:

x_refsource_CONFIRM

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commitdiff%3Bh=f4a5d0cc772127dbfe40789e26c4633ceea07d14%3Bhp=e6e8704ac9eb115624ff66e2965877d8e63a45f4	x_refsource_CONFIRM x_transferred
http://www.securityfocus.com/bid/101933	vdb-entry x_refsource_BID x_transferred
https://access.redhat.com/errata/RHEA-2017:3138	vendor-advisory x_refsource_REDHAT x_transferred
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113	x_refsource_CONFIRM x_transferred

Hyperlink: https://gerrit.ovirt.org/gitweb?p=ovirt-engine.git%3Ba=commitdiff%3Bh=f4a5d0cc772127dbfe40789e26c4633ceea07d14%3Bhp=e6e8704ac9eb115624ff66e2965877d8e63a45f4

Resource:

x_refsource_CONFIRM

x_transferred

Hyperlink: http://www.securityfocus.com/bid/101933

Resource:

vdb-entry

x_refsource_BID

x_transferred

Hyperlink: https://access.redhat.com/errata/RHEA-2017:3138

Resource:

vendor-advisory

x_refsource_REDHAT

x_transferred

Hyperlink: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15113

Resource:

x_refsource_CONFIRM

x_transferred

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:secalert@redhat.com

Published At:27 Jul, 2018 | 16:29

Updated At:07 Nov, 2023 | 02:39

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.0	6.6	MEDIUM	CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Secondary	3.0	7.2	HIGH	CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
Primary	2.0	3.5	LOW	AV:N/AC:M/Au:S/C:P/I:N/A:N

Type: Primary

Version: 3.0

Base score: 6.6

Base severity: MEDIUM

Vector:

CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.0

Base score: 7.2

Base severity: HIGH

Vector:

CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 3.5

Base severity: LOW

Vector:

AV:N/AC:M/Au:S/C:P/I:N/A:N

CPE Matches

ovirt>>ovirt>>Versions before 4.1.7.6(exclusive)

cpe:2.3:a:ovirt:ovirt:*:*:*:*:*:*:*:*

Red Hat, Inc.

>>virtualization>>4.1

cpe:2.3:a:redhat:virtualization:4.1:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-532	Primary	nvd@nist.gov
CWE-212	Secondary	secalert@redhat.com

CWE ID: CWE-532

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-212

Type: Secondary