CVE-2017-15113
ovirt-engine: DEBUG logging includes unmasked passwords
Severity
LowRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · November 13, 2017
Updated · June 30, 2026
Description
ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to troubleshoot issues.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.2CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H
CWE-212 · Improper Removal of Sensitive Information Before Storage or Transfer