Unknown Ovirt Engine vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Ovirt Engine, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2018-1073ovirtovirt-engine+3
EPSS score
1.88%
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.7.8CVE-2018-1075ovirtovirt+1
EPSS score
0.35%
ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning. When engine-setup was run and one chooses to provision the database manually or connect to a remote database, the password input was logged in cleartext during the verification step. Sharing the provisioning log might inadvertently leak database passwords.