CVE-2020-35497

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other...

6.5 MediumFix available

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.76%Up 0.3 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.

Record: CVE-2020-35497
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:P/I:N/A:N
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.

Record: CVE-2020-35497
Weakness: CWE-284
Updated: 2026-11-02

EUVDEUVD-2020-23166 No score

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.

Record: EUVD-2020-23166
Updated: 2026-11-03

GitHub AdvisoriesGHSA-wvmj-h4cr-4hm5 No score

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other...

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.

Record: GHSA-wvmj-h4cr-4hm5
Weakness: CWE-284
Updated: 2026-11-02

OSV 6.5

A flaw was found in ovirt-engine 4.4.3 and earlier allowing an authenticated user to read other users' personal information, including name, email and public SSH key.

Record: CVE-2020-35497
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVRHSA-2021:0383 6.5

Red Hat Security Advisory: RHV-M (ovirt-engine) 4.4.z security, bug fix, enhancement upd[ovirt-4.4.4] 0-day

Record: RHSA-2021:0383
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`ovirt-engine` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-backend` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-dbscripts` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-health-check-bundler` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-restapi` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-setup` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-setup-base` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-setup-plugin-cinderlib` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-setup-plugin-imageio` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-setup-plugin-ovirt-engine` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev

Show 10 moreShow less

Affected packages
Package	Affected	Fixed
`ovirt-engine-setup-plugin-ovirt-engine-common` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-setup-plugin-vmconsole-proxy-helper` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-setup-plugin-websocket-proxy` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-tools` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-tools-backup` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-vmconsole-proxy-helper` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-webadmin-portal` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`ovirt-engine-websocket-proxy` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`python3-ovirt-engine-lib` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev
`rhvm` Red Hat:rhev_manager:4.4:el8	before 0:4.4.4.7-0.2.el8ev	0:4.4.4.7-0.2.el8ev

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-35497 is a medium vulnerability (CVSS 6.5) in Ovirt Ovirt-engine, published December 21, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.76%, the 55th percentile. Fixed in ovirt-engine 0:4.4.4.7-0.2.el8ev.

References

Show 5 moreShow less