CVE-2019-10159CWE-285

cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller

Medium · published June 14, 2019

CVSS v3.0
4.3
EPSS
1%
Percentile
52.7
In the wild
Unconfirmed
What it is

cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.

The record
Technical detail
CVSS v3.0
4.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00703 · 52.7th percentile
Weakness
CWE-285 · Improper Authorization
Published
2019-06-14T13:53Z
EPSS history
Timeline
  • 14 JUN 13:53Z
    cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller
    cvelistv5