CVE-2022-2805 - Vulnerability Details - OpenCVE

A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Redhat	Rhev Manager Virtualization

Configuration 1 [-]

cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Virtualization Engine 4.4
ovirt-engine-0:4.5.3.2-1.el8ev	cpe:/a:redhat:rhev_manager:4.4:el8	RHSA-2022:8502	2022-11-16T00:00:00Z
ovirt-engine-dwh-0:4.5.7-1.el8ev	cpe:/a:redhat:rhev_manager:4.4:el8	RHSA-2022:8502	2022-11-16T00:00:00Z
ovirt-engine-ui-extensions-0:1.3.6-1.el8ev	cpe:/a:redhat:rhev_manager:4.4:el8	RHSA-2022:8502	2022-11-16T00:00:00Z
ovirt-web-ui-0:1.9.2-1.el8ev	cpe:/a:redhat:rhev_manager:4.4:el8	RHSA-2022:8502	2022-11-16T00:00:00Z

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2022-2805
https://bugzilla.redhat.com/show_bug.cgi?id=2079545
https://nvd.nist.gov/vuln/detail/CVE-2022-2805
https://www.cve.org/CVERecord?id=CVE-2022-2805

History

Fri, 09 May 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2022-10-19T00:00:00.000Z

Updated: 2025-05-09T14:33:34.709Z

Reserved: 2022-08-12T00:00:00.000Z

Link: CVE-2022-2805

Vulnrichment

Updated: 2024-08-03T00:52:58.892Z

NVD

Status : Modified

Published: 2022-10-19T18:15:12.977

Modified: 2025-05-09T15:15:53.107

Link: CVE-2022-2805

Redhat

Severity : Moderate

Publid Date: 2022-05-27T00:00:00Z

Links: CVE-2022-2805 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-2805", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "dateUpdated": "2025-05-09T14:33:34.709Z", "dateReserved": "2022-08-12T00:00:00.000Z", "datePublished": "2022-10-19T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2022-10-24T00:00:00.000Z"}, "descriptions": [{"lang": "en", "value": "A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss."}], "affected": [{"vendor": "n/a", "product": "ovirt-engine", "versions": [{"version": "ovirt-engine 4.5.3", "status": "affected"}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2079545"}, {"url": "https://access.redhat.com/security/cve/CVE-2022-2805"}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-312", "cweId": "CWE-312"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:52:58.892Z"}, "title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2079545", "tags": ["x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2022-2805", "tags": ["x_transferred"]}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-05-09T14:32:32.520420Z", "id": "CVE-2022-2805", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-09T14:33:34.709Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2079545", "tags": ["x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2022-2805", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:52:58.892Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2022-2805", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-05-09T14:32:32.520420Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-05-09T14:33:29.267Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "ovirt-engine", "versions": [{"status": "affected", "version": "ovirt-engine 4.5.3"}]}], "references": [{"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2079545"}, {"url": "https://access.redhat.com/security/cve/CVE-2022-2805"}], "descriptions": [{"lang": "en", "value": "A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-312", "description": "CWE-312"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2022-10-24T00:00:00.000Z"}}}, "cveMetadata": {"cveId": "CVE-2022-2805", "state": "PUBLISHED", "dateUpdated": "2025-05-09T14:33:34.709Z", "dateReserved": "2022-08-12T00:00:00.000Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2022-10-19T00:00:00.000Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*", "matchCriteriaId": "6BBD7A51-0590-4DDF-8249-5AFA8D645CB6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A flaw was found in ovirt-engine, which leads to the logging of plaintext passwords in the log file when using otapi-style. This flaw allows an attacker with sufficient privileges to read the log file, leading to confidentiality loss."}, {"lang": "es", "value": "Se ha encontrado un fallo en ovirt-engine, que conlleva a un registro de contrase\u00f1as en texto plano en el archivo de registro cuando es usado otapi-style. Este fallo permite a un atacante con privilegios suficientes leer el archivo de registro, conllevando a una p\u00e9rdida de confidencialidad"}], "id": "CVE-2022-2805", "lastModified": "2025-05-09T15:15:53.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2022-10-19T18:15:12.977", "references": [{"source": "[email protected]", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2022-2805"}, {"source": "[email protected]", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2079545"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2022-2805"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2079545"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-312"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-312"}], "source": "[email protected]", "type": "Secondary"}]}