Medium severity5.3OSV Advisory· Published Jun 19, 2018· Updated Jun 17, 2026

CVE-2018-1073

Description

The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker to discover the names of valid user accounts.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Ovirt/Engine2 versions
cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:ovirt:ovirt-engine:*:*:*:*:*:*:*:*range: <4.2.3
- (no CPE)range: list, ovirt-engine-3.3-beta1, ovirt-engine-3.3_beta1, …
Red Hat/Virtualization
cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*
Red Hat/Virtualization Host
cpe:2.3:a:redhat:virtualization_host:4.0:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

www.securityfocus.com/bid/104189nvdThird Party AdvisoryVDB Entry
access.redhat.com/errata/RHSA-2018:1525nvdThird Party Advisory
bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000