CVE-2016-7060 Information disclosure in n/a
Physically proximate attackers can view unmasked passwords in the Red Hat QuickStart Cloud Installer web interface, exposing sensitive credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-7060?
CVE-2016-7060 is a medium-severity vulnerability in n/a, published on 14 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The web interface in Red Hat QuickStart Cloud Installer (QCI) 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display.
Weakness: CWE-200
Which versions are affected by CVE-2016-7060?
It affects 1 product.
Linux distribution packages (2)
tfm-rubygem-fusor_ui Red Hat:qci:1.0::el7 | All versions | 0:1.0.9.1-1.el7sat |
tfm-rubygem-fusor_ui-doc Red Hat:qci:1.0::el7 | All versions | 0:1.0.9.1-1.el7sat |
Products include Redhat Quickstart Cloud Installer.
How do I fix CVE-2016-7060?
Apply the vendor's patch.
Is CVE-2016-7060 being exploited?
There is no known exploitation of CVE-2016-7060 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-w9c7-99vf-c9gw, RHSA-2017:0256.