Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interacti…

Published 7 y ago 2019-07-03 · modified 4 mo ago 2026-06-17 · JSON

CVSS

3.2

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.4%

percentile 35%

Public exploits

none known

Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.

Exploit prediction (EPSS)

0.40% probability of exploitation in the next 30 days, higher than 35% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	3.2	`CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N`
CNA	3.0	3.2	`CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N`
NVD	3.0	3.3	`CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`

Affected products

Red Hat virt-install

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10183 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/109027 · vdb-entry, x_refsource_BID, x_transferred
access.redhat.com /errata/RHSA-2019:3464 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

CVE List: CVE-2019-10183
NVD: CVE-2019-10183

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.