CVE-2018-1073 Information disclosure in ovirt-engine
An attacker can enumerate valid user accounts by observing distinct error messages in the oVirt Engine web console login form.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1073?
CVE-2018-1073 is a medium-severity vulnerability in Redhat Virtualization, published on 19 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.
Which versions are affected by CVE-2018-1073?
It affects 3 products.
Products include Ovirt Ovirt-Engine, Redhat Virtualization, Redhat Virtualization Host.
How do I fix CVE-2018-1073?
Upgrade to a fixed version.
Is CVE-2018-1073 being exploited?
There is no known exploitation of CVE-2018-1073 in the wild and no public exploit code.
Other vulnerabilities in Redhat Virtualization
- CVE-2013-4367 Misconfiguration in ovirt-engine
- CVE-2024-0822 Ovirt: authentication bypass
- CVE-2020-35497 Information disclosure in ovirt-engine
- CVE-2020-14333 Cross-site scripting in ovirt-engine
- CVE-2022-3193 An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine.
Sources
Also known as GHSA-9ghh-fm37-vrf7.