{"id":"CVE-2024-0822","aliases":["EUVD-2024-16606","GHSA-4vwj-x32h-m4vj","RHSA-2024:0934"],"status":"published","title":"Ovirt: authentication bypass","description":"An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00708,"percentile":0.53739,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1390","CWE-287"],"published":"2024-01-25T15:18:20Z","modified":"2026-10-28T02:30:40Z","fixes":[{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-backend","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-dbscripts","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-health-check-bundler","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-restapi","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-base","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-cinderlib","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-imageio","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine-common","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-vmconsole-proxy-helper","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-websocket-proxy","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools-backup","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-vmconsole-proxy-helper","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-webadmin-portal","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-websocket-proxy","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python3-ovirt-engine-lib","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]},{"ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"rhvm","fixed_in":["0:4.5.3.10-1.el8ev"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-backend","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-dbscripts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-health-check-bundler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-restapi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-cinderlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-imageio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-ovirt-engine-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-setup-plugin-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-tools-backup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-vmconsole-proxy-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-webadmin-portal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"ovirt-engine-websocket-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"python3-ovirt-engine-lib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]},{"source":"osv","ecosystem":"Red Hat:rhev_manager:4.4:el8","package":"rhvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.3.10-1.el8ev"}]}]}],"products":[{"vendor":"ovirt","product":"ovirt-engine"},{"vendor":"red hat","product":"red hat virtualization engine 4.4"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2024:0934","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-0822","tags":["vdb-entry","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258509","tags":["issue-tracking","x_refsource_REDHAT","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/oVirt/ovirt-engine/pull/914","tags":["x_transferred","fix","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-0822","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4vwj-x32h-m4vj"},{"url":"https://access.redhat.com/downloads/content/package-browser/","tags":["web"]},{"url":"https://ovirt.org/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/0xxx/CVE-2024-0822.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244641","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_0934.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-0822","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-0822","title":"Ovirt: authentication bypass","description":"An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.","status":"published","published":"2024-01-25T15:18:20.439Z","modified":"2025-11-20T07:09:22.416Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T14:34:22.852179Z"}],"euvd":[{"id":"EUVD-2024-16606","description":"An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.","status":"published","published":"2024-01-25T15:18:20Z","modified":"2025-11-20T07:09:22Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T19:49:15.042838Z"}],"ghsa":[{"id":"GHSA-4vwj-x32h-m4vj","title":"An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation...","description":"An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.","status":"published","published":"2024-01-25T18:30:51Z","modified":"2024-02-18T05:07:18Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"cwes":["CWE-287","CWE-1390"],"updated_at":"2026-11-02T14:55:37.87337Z"}],"nvd":[{"id":"CVE-2024-0822","description":"An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.","status":"published","published":"2024-01-25T16:15:08.743Z","modified":"2026-06-17T06:54:22.74Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"}],"cwes":["CWE-1390","CWE-287"],"updated_at":"2026-11-02T14:09:32.147098Z"}],"osv":[{"id":"CVE-2024-0822","title":"Ovirt: authentication bypass","description":"An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.","status":"published","published":"2024-01-25T15:18:20.439Z","modified":"2026-10-28T02:30:40.058615653Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-1390"],"updated_at":"2026-11-02T15:44:37.180532Z"},{"id":"RHSA-2024:0934","title":"Red Hat Security Advisory: Red Hat Virtualization security and bug fix update","status":"published","published":"2024-09-16T17:20:33Z","modified":"2025-11-22T13:07:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:12.787505Z"}]}}