← Zuruck zu CVEs

CVE-2019-3879

HIGH

8.1

Beschreibung

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.

CVE Details

CVSS v3.1 Bewertung8.1

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht3/25/2019

Zuletzt geandert11/21/2024

Quellenvd

Honeypot-Sichtungen0

Betroffene Produkte

ovirt:ovirtredhat:virtualization

Schwachen (CWE)

CWE-862CWE-862

Referenzen

http://www.securityfocus.com/bid/107561(secalert@redhat.com)

https://access.redhat.com/errata/RHBA-2019:0802(secalert@redhat.com)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879(secalert@redhat.com)

http://www.securityfocus.com/bid/107561(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHBA-2019:0802(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879(af854a3a-2127-422b-91ae-364da2661108)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.