Improper input validation in Red Hat Ovirt-engine-extension-aaa-jdbc
CVE-2017-2614
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accoun…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.003 (20.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L.
Affected products
- Red Hat Ovirt-engine-extension-aaa-jdbc — versions 1.1.3
- Redhat Enterprise_virtualization — versions 4.0
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-2614?
- CVE-2017-2614 is a medium-severity vulnerability in Red Hat Ovirt-engine-extension-aaa-jdbc, classified under Improper Input Validation. CVSS score: 6.8/10. Published 2018-07-27.
- How severe is CVE-2017-2614?
- Medium severity. CVSS v3 base score is 6.8 out of 10.