{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-12-04T00:00:00", "descriptions": [{"lang": "en", "value": "The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"name": "56825", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/56825"}, {"name": "RHSA-2012:1506", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1506.html"}, {"name": "enterprise-system-backend-sec-bypass(80545)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80545"}, {"name": "1027838", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1027838"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:42:31.711Z"}, "title": "CVE Program Container", "references": [{"name": "56825", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/56825"}, {"name": "RHSA-2012:1506", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1506.html"}, {"name": "enterprise-system-backend-sec-bypass(80545)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80545"}, {"name": "1027838", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1027838"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-2696", "datePublished": "2013-01-04T22:00:00", "dateReserved": "2012-05-14T00:00:00", "dateUpdated": "2024-08-06T19:42:31.711Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redhat:enterprise_virtualization_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "229DD47D-ED52-48DF-9849-6AA588A9F533", "versionEndIncluding": "3.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:enterprise_virtualization_manager:2.1:*:*:*:*:*:*:*", "matchCriteriaId": "1B952D9C-5ACF-42A4-B249-94E7B5CE0494", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:enterprise_virtualization_manager:2.2:*:*:*:*:*:*:*", "matchCriteriaId": "B84D669D-C083-48FA-A65E-838A904C25C6", "vulnerable": true}, {"criteria": "cpe:2.3:a:redhat:enterprise_virtualization_manager:2.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "3D562BFD-4E6C-441F-A41D-9FB5EB1D01C1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request."}, {"lang": "es", "value": "El \"backend\" en Red Hat Enterprise Virtualization Manager (RHEV-M) anteriores a v3.1 no comprueba los privilegios de forma adecuada, lo que permite a usuarios remotos autenticados a consultar informaci\u00f3n a trav\u00e9s de una consulta (1) SOAP o (2) GWT."}], "id": "CVE-2012-2696", "lastModified": "2025-04-11T00:51:21.963", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "LOW", "cvssData": {"accessComplexity": "LOW", "accessVector": "ADJACENT_NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 2.7, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:A/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 5.1, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2013-01-04T22:55:01.727", "references": [{"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1506.html"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/56825"}, {"source": "secalert@redhat.com", "url": "http://www.securitytracker.com/id?1027838"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80545"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1506.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/56825"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1027838"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/80545"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2012:1506", "cpe": "cpe:/a:redhat:rhev_manager:3", "package": "org.ovirt.engine-root-0:3.1.0-32", "product_name": "RHEV Manager version 3.0", "release_date": "2012-12-04T00:00:00Z"}], "bugzilla": {"description": "rhev: backend allows unprivileged queries", "id": "831565", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=831565"}, "csaw": false, "cvss": {"cvss_base_score": "2.7", "cvss_scoring_vector": "AV:A/AC:L/Au:S/C:P/I:N/A:N", "status": "verified"}, "details": ["The backend in Red Hat Enterprise Virtualization Manager (RHEV-M) before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a (1) SOAP or (2) GWT request."], "name": "CVE-2012-2696", "package_state": [{"cpe": "cpe:/:redhat:enterprise_linux:::hypervisor", "fix_state": "Will not fix", "package_name": "ovirt-engine-backend", "product_name": "Red Hat Enterprise Virtualization 2"}], "public_date": "2012-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-2696\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-2696"], "statement": "This issue does affect Red Hat Enterprise Virtualization 2 and 3.\nRed Hat Enterprise Virtualization 2 is now in Production 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Virtualization Life Cycle: https://access.redhat.com/support/policy/updates/rhev/.", "threat_severity": "Low"}