CVE-2018-1117

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

ovirt-ansible-roles before version 1.0.6 has a vulnerability due to a missing no_log directive, resulting in the 'Add oVirt Provider to ManageIQ/CloudForms' playbook inadvertently disclosing admin passwords in the provisioning log. In an environment where logs are shared with other parties, this could lead to privilege escalation.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Jun 20, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-111708.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).CVE-2018-111718.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).CVE-2018-111728.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).CVE-2018-111738.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).CVE-2018-111748.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).CVE-2018-111758.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).CVE-2018-111768.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).CVE-2018-111778.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).CVE-2018-111788.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).CVE-2018-111798.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).CVE-2018-11185.5Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating syCVE-2018-111808.8Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).
CVE-2018-1117: Critical severity, CVSS 9.8 | Vulnix