CVE-2020-35497
published 2020-12-21CVE-2020-35497: A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public…
PriorityP433medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.75%
50.7th percentile
A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ovirt | ovirt-engine | <= 4.4.3 | — |
| ovirt | ovirt-engine | — | — |
| redhat | virtualization | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:P/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wvmj-h4cr-4hm5: A flaw was found in ovirt-engine 4
ghsa_unreviewed·2022-05-24
CVE-2020-35497 [MEDIUM] CWE-284 GHSA-wvmj-h4cr-4hm5: A flaw was found in ovirt-engine 4
A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.
Red Hat
ovirt-engine: non-admin user is able to access other users public SSH key
vendor_redhat·2020-12-18·CVSS 6.5
CVE-2020-35497 [MEDIUM] CWE-284 ovirt-engine: non-admin user is able to access other users public SSH key
ovirt-engine: non-admin user is able to access other users public SSH key
A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.
A flaw was found in ovirt-engine 4.4.3 and earlier. This flaw allows an authenticated user to read other users' personal information, including the name, email, and public SSH key. The highest threat from this vulnerability is to confidentiality.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2020-12-21
Published