Description
A flaw was found in Ovirt Engine's web interface in ovirt 4.4 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user's cookies or other confidential information, or impersonate them within the application's context.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The ovirt Project | ovirt-engine | 4.4 and earlier | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.2.3-1.el8ev | RHSA-2020:3807 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.6.4-1.el8ev | RHSA-2020:3807 |
| Red Hat Rhev Manager 4 | rhvm +19 | 4.4.2.3-0.6.el8ev | RHSA-2020:3807 |
Advisories 1
- RHSA-2020:3807 Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 13, 2026