CVE-2019-3879

2019-03-2519:29:02

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.3%

JSON

It was discovered that in the ovirt’s REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.

CPENameOperatorVersion
ovirt-engineeqovirt-engine-4.3.0_rc2
ovirt-engineeqovirt-engine-3.6.0_alpha1
ovirt-engineeqovirt-engine-3.6.0_alpha2
ovirt-engineeqovirt-engine-4.3.0_alpha2
ovirt-engineeqovirt-engine-3.5.0_alpha1
ovirt-engineeqovirt-engine-4.3.0_rc
ovirt-engineeqovirt-engine-4.3.1.1
ovirt-engineeqovirt-engine-3.6.0_beta1.1
ovirt-engineeqovirt-engine-3.5.0_alpha2
ovirt-engineeqovirt-engine-3.6.0_qa1

Name	Operator	Version
ovirt-engine	eq	ovirt-engine-4.3.0_rc2
ovirt-engine	eq	ovirt-engine-3.6.0_alpha1
ovirt-engine	eq	ovirt-engine-3.6.0_alpha2
ovirt-engine	eq	ovirt-engine-4.3.0_alpha2
ovirt-engine	eq	ovirt-engine-3.5.0_alpha1
ovirt-engine	eq	ovirt-engine-4.3.0_rc
ovirt-engine	eq	ovirt-engine-4.3.1.1
ovirt-engine	eq	ovirt-engine-3.6.0_beta1.1
ovirt-engine	eq	ovirt-engine-3.5.0_alpha2
ovirt-engine	eq	ovirt-engine-3.6.0_qa1