Bug 1718080 (CVE-2019-10159) - CVE-2019-10159 cfme: Improper authorization in migration log controller allows any user to access VM migration logs
Summary: CVE-2019-10159 cfme: Improper authorization in migration log controller allow...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-10159
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1718081 1718082
Blocks: 1685593
TreeView+ depends on / blocked
 
Reported: 2019-06-06 20:37 UTC by Richard Maciel Costa
Modified: 2021-02-16 21:52 UTC (History)
13 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs available.
Clone Of:
Environment:
Last Closed: 2019-08-13 08:47:05 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:2466 0 None None None 2019-08-13 08:35:36 UTC

Description Richard Maciel Costa 2019-06-06 20:37:15 UTC 
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.
Comment 4 Laura Pardo 2019-06-10 22:54:47 UTC 
Acknowledgments:

Name: Milan Zazrivec (Red Hat)
Comment 6 errata-xmlrpc 2019-08-13 08:35:34 UTC 
This issue has been addressed in the following products:

  CloudForms Management Engine 5.10

Via RHSA-2019:2466 https://access.redhat.com/errata/RHSA-2019:2466
Comment 7 Product Security DevOps Team 2019-08-13 08:47:05 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-10159
Note You need to log in before you can comment on or make changes to this bug.