CVE-2018-1073: ovirt ovirt-engine
Vulnerability summary
CVE-2018-1073 is a medium (CVSS 5.3) vulnerability in ovirt ovirt-engine. EPSS estimates a 1.82% chance of exploitation in the next 30 days, higher than 78.7% of scored vulnerabilities.
Not severe (CVSS 5.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1Timeline
- 19-06-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.
CVSS metrics
4 scores · 2 sources · 3 versions- NVDNIST5.3MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
1.82%
Chance of exploitation in the next 30 days
Percentile
79%
Versus all other CVEs
30-day change
Decrease -0.07 pp
From 1.88% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-209Generation of Error Message Containing Sensitive InformationThe product generates an error message that includes sensitive information about its environment, users, or associated data.
- CWE-200Exposure of Sensitive Information to an Unauthorized ActorThe product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat2 products
[unknown]1 product
- ovirt-engineovirt-engine 4.2.3
Ovirt1 product
- ovirt-engine< 4.2.3
3 vendors · 4 products
References
3 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1073X Refsource CONFIRMIssue TrackingThird Party Advisory