{"containers": {"cna": {"affected": [{"product": "cfme", "vendor": "Red Hat", "versions": [{"status": "affected", "version": "5.10.4.3 and below, 5.9.9.3 and below"}]}], "descriptions": [{"lang": "en", "value": "cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available."}], "metrics": [{"cvssV3_0": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2019-08-13T13:06:06", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159"}, {"name": "RHSA-2019:2466", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2019:2466"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T22:10:09.973Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159"}, {"name": "RHSA-2019:2466", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2019:2466"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2019-10159", "datePublished": "2019-06-14T13:53:19", "dateReserved": "2019-03-27T00:00:00", "dateUpdated": "2024-08-04T22:10:09.973Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:cfme-gemset:*:*:*:*:*:*:*:*", "matchCriteriaId": "A7FD6A58-0D10-4A4C-83DD-0BC2F0234E7B", "versionEndIncluding": "5.9.9.3", "versionStartIncluding": "5.9.0.22", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:cfme-gemset:*:*:*:*:*:*:*:*", "matchCriteriaId": "65E764BE-FAC3-444E-B187-2D798BEF4DA1", "versionEndIncluding": "5.10.4.3", "versionStartIncluding": "5.10.0.33", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*", "matchCriteriaId": "04AC556D-D511-4C4C-B9FB-A089BB2FEFD5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available."}, {"lang": "es", "value": "cfme-gemset versi\u00f3n 5.10.4.3 y anteriores, versi\u00f3n 5.9.9.3 y anteriores son vulnerables a un filtrado de datos, debido a una autorizaci\u00f3n inapropiada en el controlador del registro de migraci\u00f3n. Un atacante con acceso a un usuario sin privilegios puede ingresar a todos los registros de migraci\u00f3n VM disponibles."}], "id": "CVE-2019-10159", "lastModified": "2024-11-21T04:18:32.573", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "secalert@redhat.com", "type": "Secondary"}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-06-14T14:29:00.407", "references": [{"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2466"}, {"source": "secalert@redhat.com", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/errata/RHSA-2019:2466"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-285"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Secondary"}]}

{"acknowledgement": "This issue was discovered by Milan Zazrivec (Red Hat).", "affected_release": [{"advisory": "RHSA-2019:2466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7", "package": "ansible-tower-0:3.5.1-1.el7at", "product_name": "CloudForms Management Engine 5.10", "release_date": "2019-08-13T00:00:00Z"}, {"advisory": "RHSA-2019:2466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7", "package": "cfme-0:5.10.8.0-1.el7cf", "product_name": "CloudForms Management Engine 5.10", "release_date": "2019-08-13T00:00:00Z"}, {"advisory": "RHSA-2019:2466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7", "package": "cfme-amazon-smartstate-0:5.10.8.0-1.el7cf", "product_name": "CloudForms Management Engine 5.10", "release_date": "2019-08-13T00:00:00Z"}, {"advisory": "RHSA-2019:2466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7", "package": "cfme-appliance-0:5.10.8.0-1.el7cf", "product_name": "CloudForms Management Engine 5.10", "release_date": "2019-08-13T00:00:00Z"}, {"advisory": "RHSA-2019:2466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7", "package": "cfme-gemset-0:5.10.8.0-1.el7cf", "product_name": "CloudForms Management Engine 5.10", "release_date": "2019-08-13T00:00:00Z"}, {"advisory": "RHSA-2019:2466", "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7", "package": "rubygem-nokogiri-0:1.8.5-1.el7cf", "product_name": "CloudForms Management Engine 5.10", "release_date": "2019-08-13T00:00:00Z"}], "bugzilla": {"description": "cfme: Improper authorization in migration log controller allows any user to access VM migration logs", "id": "1718080", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1718080"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.3", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "status": "verified"}, "cwe": "CWE-285", "details": ["cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.", "A data leak vulnerability was found in cfme-gemset, in versions including and prior to 5.10.4.3 and versions including and prior to 5.9.9.3, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user account can access all VM migration logs available."], "name": "CVE-2019-10159", "public_date": "2019-06-06T20:32:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2019-10159\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-10159"], "threat_severity": "Moderate"}