Red Hat Storage Console vulnerabilities

3 CVEs affecting Red Hat Storage Console, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-7481, published 2018-07-19.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-7481, published 2018-07-19. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Ansible before versions 2.3.1.0 and 2.4.0.0 fails to properly mark lookup-plugin results as unsafe. If an attacker could control the results of lookup() calls, they could inject Unicode strings to be…
CVE-2016-7062, published 2017-06-27. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. rhscon-ceph in Red Hat Storage Console 2 x86_64 and Red Hat Storage Console Node 2 x86_64 allows local users to obtain the password as cleartext.
CVE-2017-2665, published 2018-07-06. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. The skyring-setup command creates random password for mongodb skyring database but it writes password in plain text to /etc/skyring/skyring.conf file which is owned by root but read by local user.…