CVE-2024-0822 - Ovirt: authentication bypass

Back Back to CVE browser

HIGH

Ovirt: authentication bypass

Published Jan 25, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.71%

Description

An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.

Affected products

Red Hat Virtualization Engine 4.4

ovirt-engine-0:4.5.3.10-1.el8ev

Fixed · RHSA-2024:0934

Product	Package	State	Advisory
Red Hat Virtualization Engine 4.4	ovirt-engine-0:4.5.3.10-1.el8ev	Fixed	RHSA-2024:0934

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-1390

CWE-287

Improper Authentication

References (7)

https://access.redhat.com/errata/RHSA-2024:0934
vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-0822
vdb-entryx_refsource_REDHATThird Party AdvisoryVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2258509
issue-trackingx_refsource_REDHATExploitIssue TrackingThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16606
Advisory
https://github.com/oVirt/ovirt-engine/pull/914
https://nvd.nist.gov/vuln/detail/CVE-2024-0822
https://www.cve.org/CVERecord?id=CVE-2024-0822

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2024:0934		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-0822		vdb-entryx_refsource_REDHATThird Party AdvisoryVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2258509		issue-trackingx_refsource_REDHATExploitIssue TrackingThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-16606		Advisory
https://github.com/oVirt/ovirt-engine/pull/914
https://nvd.nist.gov/vuln/detail/CVE-2024-0822
https://www.cve.org/CVERecord?id=CVE-2024-0822