{"id":"CVE-2019-10159","aliases":["EUVD-2019-2192","GHSA-whhr-m9m3-wj45","RHSA-2019:2466"],"status":"published","title":"cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to...","description":"cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00703,"percentile":0.53547,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2019-06-14T13:53:19Z","modified":"2026-06-17T02:10:22Z","fixes":[{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower","fixed_in":["0:3.5.1-1.el7at"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-server","fixed_in":["0:3.5.1-1.el7at"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-setup","fixed_in":["0:3.5.1-1.el7at"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-ui","fixed_in":["0:3.5.1-1.el7at"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-venv-ansible","fixed_in":["0:3.5.1-1.el7at"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-venv-tower","fixed_in":["0:3.5.1-1.el7at"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-amazon-smartstate","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-common","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-debuginfo","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-tools","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-debuginfo","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset-debuginfo","fixed_in":["0:5.10.8.0-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-nokogiri","fixed_in":["0:1.8.5-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-nokogiri-debuginfo","fixed_in":["0:1.8.5-1.el7cf"],"sources":["osv"]},{"ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-nokogiri-doc","fixed_in":["0:1.8.5-1.el7cf"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1-1.el7at"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1-1.el7at"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1-1.el7at"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1-1.el7at"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-venv-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1-1.el7at"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"ansible-tower-venv-tower","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.5.1-1.el7at"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-amazon-smartstate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-appliance-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"cfme-gemset-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.10.8.0-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-nokogiri","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-nokogiri-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7cf"}]}]},{"source":"osv","ecosystem":"Red Hat:cloudforms_managementengine:5.10::el7","package":"rubygem-nokogiri-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.5-1.el7cf"}]}]}],"products":[{"vendor":"red hat","product":"cfme"},{"vendor":"redhat","product":"cfme-gemset"},{"vendor":"redhat","product":"cloudforms"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10159","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2466","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-10159","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-10159","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1718080","tags":["report"]},{"url":"https://github.com/advisories/GHSA-whhr-m9m3-wj45"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703461","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703474","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1723833","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1727443","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728403","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728708","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1728889","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1731157","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1731237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1731977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1731991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1731992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732117","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732156","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1733290","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1733375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1734122","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2466.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-10159","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-10159","description":"cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.","status":"published","published":"2019-06-14T13:53:19Z","modified":"2024-08-04T22:10:09.973Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:20:19.399352Z"}],"euvd":[{"id":"EUVD-2019-2192","description":"cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.","status":"published","published":"2019-06-14T13:53:19Z","modified":"2024-08-04T22:10:09Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:54.154728Z"}],"ghsa":[{"id":"GHSA-whhr-m9m3-wj45","title":"cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to...","description":"cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.","status":"published","published":"2022-05-24T16:48:04Z","modified":"2023-02-13T00:31:00Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:54:05.462623Z"}],"nvd":[{"id":"CVE-2019-10159","description":"cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An attacker with access to an unprivileged user can access all VM migration logs available.","status":"published","published":"2019-06-14T14:29:00.407Z","modified":"2026-06-17T02:10:22.873Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:05:16.285679Z"}],"osv":[{"id":"RHSA-2019:2466","title":"Red Hat Security Advisory: CloudForms 4.7.8 security, bug fix and enhancement update","status":"published","published":"2024-09-16T02:45:06Z","modified":"2026-02-21T10:03:15Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"}]}}