CVE-2018-1117CWE-532

ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms'…

Medium · published June 19, 2018

CVSS v3.0
5.0
EPSS
1%
Percentile
72.4
In the wild
Unconfirmed
What it is

ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.

The record
Technical detail
CVSS v3.0
5.0 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01406 · 72.4th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2018-06-19T13:00Z
EPSS history
Timeline
  • 19 JUN 13:00Z
    ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms'…
    cvelistv5