CVE-2022-2805

CWE-312 — Cleartext Storage of Sensitive InfoCWE-200 — Information Exposure4 documents4 sources
Severity
6.5MEDIUM
EPSS
0.1%
top 70.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Redhat Virtualization
Timeline
PublishedOct 19

Description

A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶CVEListV5ovirt-engineovirt-engine 4.5.3

🔴Vulnerability Details

2
GHSA
GHSA-r2ff-gw5r-6x3q: A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style↗2022-10-19
▶
CVEList
CVE-2022-2805: A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style↗2022-10-19
▶

📋Vendor Advisories

1
Red Hat
ovirt-engine: RHVM admin password is logged unfiltered when using otopi-style↗2022-05-27
▶