CVE-2017-2614CWE-20

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired

Medium · published July 27, 2018

CVSS v3.0
6.8
EPSS
0%
Percentile
19.3
In the wild
Unconfirmed
What it is

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.

The record
Technical detail
CVSS v3.0
6.8 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00280 · 19.3th percentile
Weakness
CWE-20 · Improper Input Validation
Published
2018-07-27T18:00Z
EPSS history
Timeline
  • 27 JUL 18:00Z
    When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired
    cvelistv5