Unspecified Ovirt Engine vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unspecified Ovirt Engine, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.7CVE-2018-1074ovirtovirt+22
EPSS score
1.44%
ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.8.1CVE-2019-3879ovirtovirt+22
EPSS score
1.83%
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.