CVE-2019-10159 Missing authorization in cfme
An unprivileged user can access all VM migration logs due to improper authorization in the migration log controller.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-10159?
CVE-2019-10159 is a medium-severity missing authorization vulnerability in Red Hat cfme, published on 14 Jun 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.
Weakness: CWE-285
Which versions are affected by CVE-2019-10159?
It affects 2 products.
Linux distribution packages (18)
ansible-tower Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:3.5.1-1.el7at |
ansible-tower-server Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:3.5.1-1.el7at |
ansible-tower-setup Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:3.5.1-1.el7at |
ansible-tower-ui Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:3.5.1-1.el7at |
ansible-tower-venv-ansible Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:3.5.1-1.el7at |
ansible-tower-venv-tower Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:3.5.1-1.el7at |
cfme Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
cfme-amazon-smartstate Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
cfme-appliance Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
cfme-appliance-common Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
cfme-appliance-debuginfo Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
cfme-appliance-tools Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
cfme-debuginfo Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
cfme-gemset Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
cfme-gemset-debuginfo Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:5.10.8.0-1.el7cf |
rubygem-nokogiri Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:1.8.5-1.el7cf |
rubygem-nokogiri-debuginfo Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:1.8.5-1.el7cf |
rubygem-nokogiri-doc Red Hat:cloudforms_managementengine:5.10::el7 | All versions | 0:1.8.5-1.el7cf |
Products include Redhat Cfme-Gemset, Redhat Cloudforms.
How do I fix CVE-2019-10159?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-10159 being exploited?
There is no known exploitation of CVE-2019-10159 in the wild and no public exploit code.
Sources
Also known as GHSA-whhr-m9m3-wj45, RHSA-2019:2466.