EUVD-2019-13490

Malware in sbrugna...

Design/Logic Flaw

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges eg Basic Operations could exploit this flaw to...

CVE-2019-3879

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges eg Basic Operations could exploit this flaw to...

PT-2019-16751

Name of the Vulnerable Software and Affected Versions oVirt versions prior to 4.3.2.1 Description A flaw was discovered in oVirt's REST API where the RemoveDiskCommand is triggered as an internal command, bypassing permission validation against the calling user. This allows a user with low...

CVE-2019-3879: Missing Authorization

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges eg Basic Operations could exploit this flaw to...