CVE-2017-2614

When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts.

CVSS v3 6.8 MEDIUM
CVSS v2.0 2.1 LOW

6.8^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Exploitability : 2.5 / Impact : 3.7

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2017-0257.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614	Issue Tracking Vendor Advisory
http://rhn.redhat.com/errata/RHSA-2017-0257.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614	Issue Tracking Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redhat:enterprise_virtualization:4.0:*:*:*:*:*:*:*

History

21 Nov 2024, 03:23

Type	Values Removed	Values Added
References	~~() http://rhn.redhat.com/errata/RHSA-2017-0257.html - Vendor Advisory~~	() http://rhn.redhat.com/errata/RHSA-2017-0257.html - Vendor Advisory
References	~~() https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614 - Issue Tracking, Vendor Advisory~~	() https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614 - Issue Tracking, Vendor Advisory
CVSS	v2 : ~~2.1~~ v3 : ~~6.3~~	v2 : 2.1 v3 : 6.8

Information

Published : 2018-07-27 18:29

Updated : 2024-11-21 03:23

NVD link : CVE-2017-2614

Mitre link : CVE-2017-2614

CVE.ORG link : CVE-2017-2614

JSON object : View

Products Affected

redhat

enterprise_virtualization

CWE

CWE-20

Improper Input Validation

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2017-2614", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": true, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.0", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 2.0}]}, "published": "2018-07-27T18:29:00.687", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2017-0257.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0257.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2614", "tags": ["Issue Tracking", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password if it is expired. This would allow access to an attacker with access to change the password on accounts with expired passwords, gaining access to those accounts."}, {"lang": "es", "value": "Cuando se actualiza una contrase\u00f1a en la base de datos rhvm, las herramientas de ovirt-aaaa-jdbc-tool en versiones anteriores a la 1.1.3 no verifican correctamente si la contrase\u00f1a actual ha caducado. Esto permitir\u00eda el acceso a un atacante con acceso para cambiar la contrase\u00f1a en cuentas con contrase\u00f1as caducadas, obteniendo acceso a esas cuentas."}], "lastModified": "2024-11-21T03:23:50.067", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redhat:enterprise_virtualization:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "12544770-1AF9-4DD3-BC72-579DA0BC0F3E"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}