CVE-2020-35497: Infoleak
A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.
Other sources
Standard user is able to fetch admin user's record and one of the linked resources(ssh keys).
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is CVE-2020-35497?
CVE-2020-35497 is a vulnerability in oVirt Engine 4.4.3 and earlier that allows an authenticated user to read other users' personal information.
How severe is CVE-2020-35497?
CVE-2020-35497 has a severity score of 6.5 (medium).
Which versions of oVirt Engine are affected?
oVirt Engine versions up to and including 4.4.3 are affected by CVE-2020-35497.
How can an authenticated user exploit CVE-2020-35497?
An authenticated user can exploit CVE-2020-35497 to read other users' personal information, including name, email, and public SSH key.
Is there a fix for CVE-2020-35497?
Yes, the recommended fix for CVE-2020-35497 is to update to version 4.4.4.7.