Description
The setup script in ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports (rhevm-reports) package before 3.3.3, stores the reports database password in cleartext, which allows local users to obtain sensitive information by reading an unspecified file.
References (2)
Core 2
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/67682
Vendor Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2014-0558.html
Scores
EPSS
0.0037
EPSS Percentile
29.7%
Details
CWE
CWE-310
Status
published
Products (4)
redhat/rhevm-reports
3.0
redhat/rhevm-reports
3.1
redhat/rhevm-reports
3.2
redhat/rhevm-reports
< 3.3
Published
May 29, 2014
Tracked Since
Feb 18, 2026