Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions.

Published 7 y ago 2019-07-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

5.9

v3.0 · CNA

CISA KEV

not known exploited

EPSS

0.3%

percentile 28%

Public exploits

none known

Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions. were found to be insufficiently protected. Passwords could be disclosed in log files (if playbooks are run with -v) or in playbooks stored on Metrics or Bastion hosts.

Exploit prediction (EPSS)

0.34% probability of exploitation in the next 30 days, higher than 28% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	3.0	5.9	`CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N`
NVD	3.1	5.5	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`
CNA	3.0	5.9	`CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`

Affected products

Red Hat ovirt-engine-metrics

Classification

Weakness

CWE-532 Insertion of Sensitive Information into Log File

References

bugzilla.redhat.com /show_bug.cgi?id=CVE-2019-10194 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/109140 · vdb-entry, x_refsource_BID, x_transferred
access.redhat.com /errata/RHSA-2019:2499 · vendor-advisory, x_refsource_REDHAT, x_transferred

Sources

CVE List: CVE-2019-10194
NVD: CVE-2019-10194

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.