CVE-2018-1072

CVE-2018-1072 is a critical information exposure vulnerability affecting oVirt Engine versions prior to 4.2.2 and Red Hat Enterprise Virtualization Manager. When the engine-backup utility was executed with provisioning options, database credentials were logged in cleartext, potentially leaking sensitive information. This vulnerability carries a CVSS score of 9.8 (Critical), indicating a high-impact, easily exploitable flaw that could lead to complete compromise of confidentiality, integrity, and availability. The attack vector is network-based with low attack complexity, requiring no user interaction or privileges. While there is no evidence of active exploitation or public exploit code (Metasploit, Nuclei, ExploitDB), the vulnerability has garnered significant community discussion with 10 mentions, suggesting awareness among security researchers. It is not listed on the CISA KEV catalog.