What’s Vulnerable › Vulnerabilities

CVE-2018-1074

• Severity: high (CVSS 7.2 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-04-26 · updated 2026-06-17
• Weakness: CWE-200

Description

ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure of Power Management credentials, including cleartext passwords to Host Administrators. A Host Administrator could use this flaw to gain access to the power management systems of hosts they control.

Affected products

• [UNKNOWN] ovirt-engine: through 4.1.11.1
• RedHat Enterprise Virtualization: 4.0

References

• https://access.redhat.com/errata/RHBA-2018:1219
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1074
• https://access.redhat.com/errata/RHBA-2018:1219
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1074

Get alerted when CVE-2018-1074 or the next vulnerability affects your stack