Virt-install(1) utility used to provision new virtual machines has introduced an option '--unattended' to create VMs without user interaction. This option accepts guest VM password as command line arguments, thus leaking them to others users on the system via process listing. It was introduced recently in the virt-manager v2.2.0 release.
CVSS Details
- CVSS 3.1 Base Score: 3.3
- CVSS 3.0 Base Score: 3.2
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade virt-manager | Aug 22, 2024 | Jul 3, 2019 |
| Centos_linux | — | Upgrade virt-installUpgrade virt-managerUpgrade virt-manager-common | Nov 6, 2019 | Jul 3, 2019 |
| Oracle_linux | — | Upgrade virt-installUpgrade virt-managerUpgrade virt-manager-common | Nov 22, 2019 | Jul 2, 2019 |
| Redhat_linux | — | Upgrade virt-managerUpgrade virt-installUpgrade virt-manager-common | Nov 6, 2019 | Jul 3, 2019 |
| Suse | — | Upgrade virt-installUpgrade virt-manager-commonUpgrade virt-manager | Feb 4, 2022 | Jul 3, 2019 |
| Ubuntu | — | Upgrade virt-manager | Nov 19, 2024 | Jul 3, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub