CVE-2018-1074

2018-04-2617:29:00

Google

osv.dev

0.001 Low

EPSS

Percentile

44.0%

JSON

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.

CPENameOperatorVersion
ovirt-engineeqovirt-engine-4.1.7
ovirt-engineeqovirt-engine-4.1.7.1
ovirt-engineeqovirt-engine-3.6.0_beta1
ovirt-engineeqovirt-engine-4.1.6.2
ovirt-engineeqovirt-engine-4.1.10.2
ovirt-engineeqovirt-engine-3.6.0_beta1.1
ovirt-engineeqovirt-engine-4.1.8.2
ovirt-engineeqovirt-engine-4.1.1
ovirt-engineeqovirt-engine-4.1.10.1
ovirt-engineeqovirt-engine-4.1.3.5

Name	Operator	Version
ovirt-engine	eq	ovirt-engine-4.1.7
ovirt-engine	eq	ovirt-engine-4.1.7.1
ovirt-engine	eq	ovirt-engine-3.6.0_beta1
ovirt-engine	eq	ovirt-engine-4.1.6.2
ovirt-engine	eq	ovirt-engine-4.1.10.2
ovirt-engine	eq	ovirt-engine-3.6.0_beta1.1
ovirt-engine	eq	ovirt-engine-4.1.8.2
ovirt-engine	eq	ovirt-engine-4.1.1
ovirt-engine	eq	ovirt-engine-4.1.10.1
ovirt-engine	eq	ovirt-engine-4.1.3.5