CVE-2019-10183

2019-07-0313:36:47

CWE-200

redhat

www.cve.org

CVSS3

3.2

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N

AI Score

3.8

Confidence

High

EPSS

0.001

Percentile

29.5%

JSON

Virt-install(1) utility used to provision new virtual machines has introduced an option ‘–unattended’ to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.

CNA Affected

[
  {
    "product": "virt-install",
    "vendor": "Red Hat",
    "versions": [
      {
        "status": "affected",
        "version": "from virt-manager v2.2.0"
      }
    ]
  }
]