CVE-2017-2614
CVE-2017-2614
Vexday Risk Score
13Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 6.8EPSS 0.3%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Lifecycle
27 Jul 2018Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.
CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
Affected products
Red Hat · ovirt-engine-extension-aaa-jdbcWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →