CVE-2019-10159
Last modified
CVE-2019-10159 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.. EPSS estimates a 0.72% chance of exploitation in the next 30 days.
Description
cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redhat | Cfme-Gemset | >= 5.9.0.22, <= 5.9.9.3 |
| Redhat | Cfme-Gemset | >= 5.10.0.33, <= 5.10.4.3 |
| Redhat | Cloudforms | 4.7 |
References
- https://access.redhat.com/errata/RHSA-2019:2466Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159Issue Tracking, Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:2466Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159Issue Tracking, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-10159?
How severe is CVE-2019-10159?
How do I fix CVE-2019-10159?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-10153A flaw was discovered in fence-agents, prior to version 4.3.…5
- CVE-2019-10154A flaw was found in Moodle before versions 3.7, 3.6.4. A web…7.5
- CVE-2019-10155The Libreswan Project has found a vulnerability in the proce…3.1
- CVE-2019-10156A flaw was discovered in the way Ansible templating was impl…5.4
- CVE-2019-10157It was found that Keycloak's Node.js adapter before version …4.7
- CVE-2019-10158A flaw was found in Infinispan through version 9.4.14.Final.…9.8
- CVE-2019-1016An information disclosure vulnerability exists when the Wind…4.7
- CVE-2019-10160A security regression of CVE-2019-9636 was discovered in pyt…9.8
- CVE-2019-10161It was discovered that libvirtd before versions 4.10.1 and 5…7.8
- CVE-2019-10162A vulnerability has been found in PowerDNS Authoritative Ser…7.5
- CVE-2019-10163A Vulnerability has been found in PowerDNS Authoritative Ser…4.3
- CVE-2019-10164PostgreSQL versions 10.x before 10.9 and versions 11.x befor…8.8
Are you affected by CVE-2019-10159?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST