CVE-2019-10159 cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged u...
MediumCVSS 4.3
EPSS 0.70%
- Published
- Updated
- Exploit status
- No public exploit known
Description
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat cfme-gemset | >= 5.9.0.22, <= 5.9.9.3 | No fix listed |
| redhat cfme-gemset | >= 5.10.0.33, <= 5.10.4.3 | No fix listed |
| redhat cloudforms | = 4.7 | No fix listed |
| redhat cfme | = 5.10.4.3 and below, 5.9.9.3 and below | No fix listed |
References
- RHSA-2019:2466 third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory