CVE-2024-7259

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-7259", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-07-30T01:00:27.812Z", "datePublished": "2024-09-26T15:15:56.980Z", "dateUpdated": "2026-11-06T07:07:56.062Z"}, "containers": {"cna": {"title": "Ovirt-engine: potential exposure of cleartext provider passwords via web ui", "metrics": [{"other": {"content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext."}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "4.5.7", "versionType": "semver"}], "packageName": "ovirt-engine", "collectionURL": "https://github.com/oVirt/ovirt-engine", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Virtualization 4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovirt-engine", "defaultStatus": "affected", "cpes": ["cpe:/a:redhat:rhev_manager:4"]}], "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-7259", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314229", "name": "RHBZ#2314229", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/oVirt/ovirt-engine/commit/4ad930699509a060490e07ed8620cccbb3a24897"}, {"url": "https://github.com/oVirt/ovirt-engine/pull/969"}, {"url": "https://github.com/oVirt/ovirt-engine/pull/970"}], "datePublic": "2024-09-26T15:00:00.000Z", "problemTypes": [{"descriptions": [{"cweId": "CWE-312", "description": "Cleartext Storage of Sensitive Information", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-312: Cleartext Storage of Sensitive Information", "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "timeline": [{"lang": "en", "time": "2024-09-23T15:07:14.058Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-09-26T15:00:00.000Z", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T07:07:56.062Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-26T15:45:53.572941Z", "id": "CVE-2024-7259", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T15:50:53.467Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-7259", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-26T15:45:53.572941Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-26T15:50:49.334Z"}}], "cna": {"title": "Ovirt-engine: potential exposure of cleartext provider passwords via web ui", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Moderate", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}}], "affected": [{"versions": [{"status": "affected", "version": "0", "lessThan": "4.5.7", "versionType": "semver"}], "packageName": "ovirt-engine", "collectionURL": "https://github.com/oVirt/ovirt-engine", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:rhev_manager:4"], "vendor": "Red Hat", "product": "Red Hat Virtualization 4", "packageName": "ovirt-engine", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2024-09-23T15:07:14.058Z", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-09-26T15:00:00.000Z", "value": "Made public."}], "datePublic": "2024-09-26T15:00:00.000Z", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2024-7259", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314229", "name": "RHBZ#2314229", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/oVirt/ovirt-engine/commit/4ad930699509a060490e07ed8620cccbb3a24897"}, {"url": "https://github.com/oVirt/ovirt-engine/pull/969"}, {"url": "https://github.com/oVirt/ovirt-engine/pull/970"}], "workarounds": [{"lang": "en", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "Cleartext Storage of Sensitive Information"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2026-11-06T07:07:56.062Z"}, "x_redhatCweChain": "CWE-312: Cleartext Storage of Sensitive Information"}}, "cveMetadata": {"cveId": "CVE-2024-7259", "state": "PUBLISHED", "dateUpdated": "2026-11-06T07:07:56.062Z", "dateReserved": "2024-07-30T01:00:27.812Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-09-26T15:15:56.980Z", "assignerShortName": "redhat"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://github.com/oVirt/ovirt-engine", "defaultStatus": "unaffected", "packageName": "ovirt-engine", "versions": [{"lessThan": "4.5.7", "status": "affected", "version": "0", "versionType": "semver"}]}, {"collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "cpes": ["cpe:/a:redhat:rhev_manager:4"], "defaultStatus": "affected", "packageName": "ovirt-engine", "product": "Red Hat Virtualization 4", "vendor": "Red Hat"}], "source": "secalert@redhat.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:*", "matchCriteriaId": "EC65CEF4-B174-47BC-A2C1-58DDB1EE56D2", "versionEndExcluding": "4.5.7", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext."}, {"lang": "es", "value": "Se encontr\u00f3 una falla en oVirt. Un usuario con privilegios de administrador, incluidos los usuarios con el permiso ReadOnlyAdmin, puede usar las herramientas para desarrolladores del navegador para ver las contrase\u00f1as del proveedor en texto plano."}], "id": "CVE-2024-7259", "lastModified": "2026-11-06T08:17:15.287", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-7259", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2024-09-26T15:45:53.572941Z", "version": "2.0.3"}}]}, "published": "2024-09-26T16:15:08.997", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2024-7259"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314229"}, {"source": "secalert@redhat.com", "url": "https://github.com/oVirt/ovirt-engine/commit/4ad930699509a060490e07ed8620cccbb3a24897"}, {"source": "secalert@redhat.com", "url": "https://github.com/oVirt/ovirt-engine/pull/969"}, {"source": "secalert@redhat.com", "url": "https://github.com/oVirt/ovirt-engine/pull/970"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "secalert@redhat.com", "type": "Secondary"}]}

{"bugzilla": {"description": "ovirt-engine: potential exposure of cleartext Provider passwords via web ui", "id": "2314229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2314229"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N", "status": "draft"}, "cwe": "CWE-312", "details": ["A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext.", "A flaw was found in oVirt. A user with administrator privileges, including users with the ReadOnlyAdmin permission, may be able to use browser developer tools to view Provider passwords in cleartext."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2024-7259", "package_state": [{"cpe": "cpe:/o:redhat:rhev_hypervisor:4", "fix_state": "Will not fix", "package_name": "ovirt-engine", "product_name": "Red Hat Virtualization 4"}], "public_date": "2024-09-26T15:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-7259\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-7259"], "threat_severity": "Moderate"}

{}