CVE-2024-0822 - Vulnerability Details

Vendors	Products
Ovirt	Ovirt-engine
Redhat	Rhev Manager

Package	CPE	Advisory	Released Date
Red Hat Virtualization Engine 4.4
ovirt-engine-0:4.5.3.10-1.el8ev	cpe:/a:redhat:rhev_manager:4.4:el8	RHSA-2024:0934	2024-02-21T00:00:00Z

Link	Providers
https://access.redhat.com/errata/RHSA-2024:0934
https://access.redhat.com/security/cve/CVE-2024-0822
https://bugzilla.redhat.com/show_bug.cgi?id=2258509
https://github.com/oVirt/ovirt-engine/pull/914
https://nvd.nist.gov/vuln/detail/CVE-2024-0822
https://www.cve.org/CVERecord?id=CVE-2024-0822

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-0822", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "state": "PUBLISHED", "assignerShortName": "redhat", "dateReserved": "2024-01-23T14:15:45.514Z", "datePublished": "2024-01-25T15:18:20.439Z", "dateUpdated": "2024-11-24T12:16:28.423Z"}, "containers": {"cna": {"title": "Ovirt: authentication bypass", "metrics": [{"other": {"content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}, "type": "Red Hat severity rating"}}, {"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command."}], "affected": [{"versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.6", "versionType": "semver"}], "packageName": "ovirt-engine", "collectionURL": "https://ovirt.org/", "defaultStatus": "unaffected"}, {"vendor": "Red Hat", "product": "Red Hat Virtualization Engine 4.4", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "packageName": "ovirt-engine", "defaultStatus": "affected", "versions": [{"version": "0:4.5.3.10-1.el8ev", "lessThan": "*", "versionType": "rpm", "status": "unaffected"}], "cpes": ["cpe:/a:redhat:rhev_manager:4.4:el8"]}], "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0934", "name": "RHSA-2024:0934", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-0822", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258509", "name": "RHBZ#2258509", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/oVirt/ovirt-engine/pull/914"}], "datePublic": "2024-01-15T00:00:00+00:00", "problemTypes": [{"descriptions": [{"cweId": "CWE-1390", "description": "Weak Authentication", "lang": "en", "type": "CWE"}]}], "x_redhatCweChain": "CWE-1390: Weak Authentication", "timeline": [{"lang": "en", "time": "2024-01-15T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-01-15T00:00:00+00:00", "value": "Made public."}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-11-24T12:16:28.423Z"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.983Z"}, "title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0934", "name": "RHSA-2024:0934", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-0822", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258509", "name": "RHBZ#2258509", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://github.com/oVirt/ovirt-engine/pull/914", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-09-12T18:40:10.525825Z", "id": "CVE-2024-0822", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T18:41:28.359Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-0822 (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

state : PUBLISHED (string)

assignerShortName : redhat (string)

dateReserved : 2024-01-23T14:15:45.514Z (string)

datePublished : 2024-01-25T15:18:20.439Z (string)

dateUpdated : 2024-11-24T12:16:28.423Z (string)

}

containers : { »

cna : { »

title : Ovirt: authentication bypass (string)

metrics : [ »

0 : { »

other : { »

content : { »

value : Important (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

type : Red Hat severity rating (string)

}

1 : { »

cvssV3_1 : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command. (string)

}

]

affected : [ »

0 : { »

versions : [ »

0 : { »

status : affected (string)

version : 4.5.0 (string)

lessThan : 4.5.6 (string)

versionType : semver (string)

}

]

packageName : ovirt-engine (string)

collectionURL : https://ovirt.org/ (string)

defaultStatus : unaffected (string)

}

1 : { »

vendor : Red Hat (string)

product : Red Hat Virtualization Engine 4.4 (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

packageName : ovirt-engine (string)

defaultStatus : affected (string)

versions : [ »

0 : { »

version : 0:4.5.3.10-1.el8ev (string)

lessThan : * (string)

versionType : rpm (string)

status : unaffected (string)

}

]

cpes : [ »

0 : cpe:/a:redhat:rhev_manager:4.4:el8 (string)

]

}

]

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:0934 (string)

name : RHSA-2024:0934 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://access.redhat.com/security/cve/CVE-2024-0822 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

2 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2258509 (string)

name : RHBZ#2258509 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

3 : { »

url : https://github.com/oVirt/ovirt-engine/pull/914 (string)

}

]

datePublic : 2024-01-15T00:00:00+00:00 (string)

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-1390 (string)

description : Weak Authentication (string)

lang : en (string)

type : CWE (string)

}

]

}

]

x_redhatCweChain : CWE-1390: Weak Authentication (string)

timeline : [ »

0 : { »

lang : en (string)

time : 2024-01-15T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2024-01-15T00:00:00+00:00 (string)

value : Made public. (string)

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2024-11-24T12:16:28.423Z (string)

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T18:18:18.983Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:0934 (string)

name : RHSA-2024:0934 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://access.redhat.com/security/cve/CVE-2024-0822 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

2 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2258509 (string)

name : RHBZ#2258509 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

3 : { »

url : https://github.com/oVirt/ovirt-engine/pull/914 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-09-12T18:40:10.525825Z (string)

id : CVE-2024-0822 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-12T18:41:28.359Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0934", "name": "RHSA-2024:0934", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-0822", "tags": ["vdb-entry", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258509", "name": "RHBZ#2258509", "tags": ["issue-tracking", "x_refsource_REDHAT", "x_transferred"]}, {"url": "https://github.com/oVirt/ovirt-engine/pull/914", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T18:18:18.983Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-0822", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-09-12T18:40:10.525825Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-12T18:40:22.116Z"}}], "cna": {"title": "Ovirt: authentication bypass", "metrics": [{"other": {"type": "Red Hat severity rating", "content": {"value": "Important", "namespace": "https://access.redhat.com/security/updates/classification/"}}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"versions": [{"status": "affected", "version": "4.5.0", "lessThan": "4.5.6", "versionType": "semver"}], "packageName": "ovirt-engine", "collectionURL": "https://ovirt.org/", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/a:redhat:rhev_manager:4.4:el8"], "vendor": "Red Hat", "product": "Red Hat Virtualization Engine 4.4", "versions": [{"status": "unaffected", "version": "0:4.5.3.10-1.el8ev", "lessThan": "*", "versionType": "rpm"}], "packageName": "ovirt-engine", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}], "timeline": [{"lang": "en", "time": "2024-01-15T00:00:00+00:00", "value": "Reported to Red Hat."}, {"lang": "en", "time": "2024-01-15T00:00:00+00:00", "value": "Made public."}], "datePublic": "2024-01-15T00:00:00+00:00", "references": [{"url": "https://access.redhat.com/errata/RHSA-2024:0934", "name": "RHSA-2024:0934", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "https://access.redhat.com/security/cve/CVE-2024-0822", "tags": ["vdb-entry", "x_refsource_REDHAT"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258509", "name": "RHBZ#2258509", "tags": ["issue-tracking", "x_refsource_REDHAT"]}, {"url": "https://github.com/oVirt/ovirt-engine/pull/914"}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1390", "description": "Weak Authentication"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2024-11-24T12:16:28.423Z"}, "x_redhatCweChain": "CWE-1390: Weak Authentication"}}, "cveMetadata": {"cveId": "CVE-2024-0822", "state": "PUBLISHED", "dateUpdated": "2024-11-24T12:16:28.423Z", "dateReserved": "2024-01-23T14:15:45.514Z", "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "datePublished": "2024-01-25T15:18:20.439Z", "assignerShortName": "redhat"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:0934 (string)

name : RHSA-2024:0934 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

1 : { »

url : https://access.redhat.com/security/cve/CVE-2024-0822 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

2 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2258509 (string)

name : RHBZ#2258509 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

3 : { »

url : https://github.com/oVirt/ovirt-engine/pull/914 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-01T18:18:18.983Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-0822 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-09-12T18:40:10.525825Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-09-12T18:40:22.116Z (string)

}

]

cna : { »

title : Ovirt: authentication bypass (string)

metrics : [ »

0 : { »

other : { »

type : Red Hat severity rating (string)

content : { »

value : Important (string)

namespace : https://access.redhat.com/security/updates/classification/ (string)

}

1 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 7.5 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

integrityImpact : HIGH (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

]

affected : [ »

0 : { »

versions : [ »

0 : { »

status : affected (string)

version : 4.5.0 (string)

lessThan : 4.5.6 (string)

versionType : semver (string)

}

]

packageName : ovirt-engine (string)

collectionURL : https://ovirt.org/ (string)

defaultStatus : unaffected (string)

}

1 : { »

cpes : [ »

0 : cpe:/a:redhat:rhev_manager:4.4:el8 (string)

]

vendor : Red Hat (string)

product : Red Hat Virtualization Engine 4.4 (string)

versions : [ »

0 : { »

status : unaffected (string)

version : 0:4.5.3.10-1.el8ev (string)

lessThan : * (string)

versionType : rpm (string)

}

]

packageName : ovirt-engine (string)

collectionURL : https://access.redhat.com/downloads/content/package-browser/ (string)

defaultStatus : affected (string)

}

]

timeline : [ »

0 : { »

lang : en (string)

time : 2024-01-15T00:00:00+00:00 (string)

value : Reported to Red Hat. (string)

}

1 : { »

lang : en (string)

time : 2024-01-15T00:00:00+00:00 (string)

value : Made public. (string)

}

]

datePublic : 2024-01-15T00:00:00+00:00 (string)

references : [ »

0 : { »

url : https://access.redhat.com/errata/RHSA-2024:0934 (string)

name : RHSA-2024:0934 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

1 : { »

url : https://access.redhat.com/security/cve/CVE-2024-0822 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_REDHAT (string)

]

}

2 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=2258509 (string)

name : RHBZ#2258509 (string)

tags : [ »

0 : issue-tracking (string)

1 : x_refsource_REDHAT (string)

]

}

3 : { »

url : https://github.com/oVirt/ovirt-engine/pull/914 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-1390 (string)

description : Weak Authentication (string)

}

]

}

]

providerMetadata : { »

orgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

shortName : redhat (string)

dateUpdated : 2024-11-24T12:16:28.423Z (string)

}

x_redhatCweChain : CWE-1390: Weak Authentication (string)

}

cveMetadata : { »

cveId : CVE-2024-0822 (string)

state : PUBLISHED (string)

dateUpdated : 2024-11-24T12:16:28.423Z (string)

dateReserved : 2024-01-23T14:15:45.514Z (string)

assignerOrgId : 53f830b8-0a3f-465b-8143-3b8a9948e749 (string)

datePublished : 2024-01-25T15:18:20.439Z (string)

assignerShortName : redhat (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:ovirt:ovirt-engine:-:*:*:*:*:*:*:*", "matchCriteriaId": "DF146A38-CD7E-4A6D-9343-EB0ACA61D5EC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command."}, {"lang": "es", "value": "Se encontr\u00f3 una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en overt-engine. Este fallo permite la creaci\u00f3n de usuarios en el sistema sin autenticaci\u00f3n debido a un fallo en el comando CreateUserSession."}], "id": "CVE-2024-0822", "lastModified": "2024-11-21T08:47:26.913", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "secalert@redhat.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2024-01-25T16:15:08.743", "references": [{"source": "secalert@redhat.com", "url": "https://access.redhat.com/errata/RHSA-2024:0934"}, {"source": "secalert@redhat.com", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2024-0822"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258509"}, {"source": "secalert@redhat.com", "url": "https://github.com/oVirt/ovirt-engine/pull/914"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2024:0934"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://access.redhat.com/security/cve/CVE-2024-0822"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258509"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/oVirt/ovirt-engine/pull/914"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1390"}], "source": "secalert@redhat.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:ovirt:ovirt-engine:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DF146A38-CD7E-4A6D-9343-EB0ACA61D5EC (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command. (string)

}

1 : { »

lang : es (string)

value : Se encontró una vulnerabilidad de omisión de autenticación en overt-engine. Este fallo permite la creación de usuarios en el sistema sin autenticación debido a un fallo en el comando CreateUserSession. (string)

}

]

id : CVE-2024-0822 (string)

lastModified : 2024-11-21T08:47:26.913 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : NONE (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2024-01-25T16:15:08.743 (string)

references : [ »

0 : { »

source : secalert@redhat.com (string)

url : https://access.redhat.com/errata/RHSA-2024:0934 (string)

}

1 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2024-0822 (string)

}

2 : { »

source : secalert@redhat.com (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Third Party Advisory (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2258509 (string)

}

3 : { »

source : secalert@redhat.com (string)

url : https://github.com/oVirt/ovirt-engine/pull/914 (string)

}

4 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://access.redhat.com/errata/RHSA-2024:0934 (string)

}

5 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://access.redhat.com/security/cve/CVE-2024-0822 (string)

}

6 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Third Party Advisory (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=2258509 (string)

}

7 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://github.com/oVirt/ovirt-engine/pull/914 (string)

}

]

sourceIdentifier : secalert@redhat.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-1390 (string)

}

]

source : secalert@redhat.com (string)

type : Secondary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-287 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2024:0934", "cpe": "cpe:/a:redhat:rhev_manager:4.4:el8", "package": "ovirt-engine-0:4.5.3.10-1.el8ev", "product_name": "Red Hat Virtualization Engine 4.4", "release_date": "2024-02-21T00:00:00Z"}], "bugzilla": {"description": "ovirt: authentication bypass", "id": "2258509", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2258509"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "verified"}, "cwe": "CWE-1390", "details": ["An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.", "An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command."], "name": "CVE-2024-0822", "public_date": "2024-01-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2024-0822\nhttps://nvd.nist.gov/vuln/detail/CVE-2024-0822\nhttps://github.com/oVirt/ovirt-engine/pull/914"], "threat_severity": "Important"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2024:0934 (string)

cpe : cpe:/a:redhat:rhev_manager:4.4:el8 (string)

package : ovirt-engine-0:4.5.3.10-1.el8ev (string)

product_name : Red Hat Virtualization Engine 4.4 (string)

release_date : 2024-02-21T00:00:00Z (string)

}

]

bugzilla : { »

description : ovirt: authentication bypass (string)

id : 2258509 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2258509 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.5 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N (string)

status : verified (string)

}

cwe : CWE-1390 (string)

details : [ »

0 : An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command. (string)

1 : An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command. (string)

]

name : CVE-2024-0822 (string)

public_date : 2024-01-15T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2024-0822 https://nvd.nist.gov/vuln/detail/CVE-2024-0822 https://github.com/oVirt/ovirt-engine/pull/914 (string)

]

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact None

User Interaction None

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object