CVE-2019-10159

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2019-10159
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:S/C:P/I:N/A:N

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References
Link Resource
https://access.redhat.com/errata/RHSA-2019:2466 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159 Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:redhat:cfme-gemset:*:*:*:*:*:*:*:*
cpe:2.3:a:redhat:cfme-gemset:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*
History

12 Feb 2023, 23:33

Type Values Removed Values Added
Summary A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs available. cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.
CWE NVD-CWE-Other CWE-285
References
  • {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1718080', 'name': 'https://bugzilla.redhat.com/show_bug.cgi?id=1718080', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2019-10159', 'name': 'https://access.redhat.com/security/cve/CVE-2019-10159', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 21:18

Type Values Removed Values Added
References
  • (MISC) https://bugzilla.redhat.com/show_bug.cgi?id=1718080 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2019-10159 -
Summary cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available. A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs available.

02 Nov 2021, 19:31

Type Values Removed Values Added
CWE CWE-532 NVD-CWE-Other
References (REDHAT) https://access.redhat.com/errata/RHSA-2019:2466 - (REDHAT) https://access.redhat.com/errata/RHSA-2019:2466 - Third Party Advisory
CPE cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*
Information

Published : 2019-06-14 14:29

Updated : 2023-12-10 12:59

NVD link : CVE-2019-10159

Mitre link : CVE-2019-10159

CVE.ORG link : CVE-2019-10159

JSON object : View

Products Affected

redhat

  • cfme-gemset
  • cloudforms
CWE
CWE-285

Improper Authorization

NVD-CWE-Other