CVE-2019-3879CWE-862

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation…

Medium · published March 25, 2019

CVSS v3.0
6.5
EPSS
2%
Percentile
78.7
In the wild
Unconfirmed
What it is

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.

The record
Technical detail
CVSS v3.0
6.5 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01830 · 78.7th percentile
Weakness
CWE-862 · Missing Authorization
Published
2019-03-25T18:30Z
EPSS history
Timeline
  • 25 MAR 18:30Z
    It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation…
    cvelistv5