CVE-2019-19350

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ansible-service-broker as shipped in Red Hat Openshift 4 and 3.11. An attacker with access to the container could use this flaw to modify /etc/passwd and escalate their privileges.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-266

Affected software

Vendor	Product	Versions
n/a	openshift/ansible-service-broker	as shipped in Red Hat Openshift 4 and 3.11

References

https://bugzilla.redhat.com/show_bug.cgi?id=1791534Exploit, Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1793283Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1791534Exploit, Issue Tracking, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1793283Issue Tracking, Vendor Advisory

Timeline

Published: Mar 24, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-193517.0An insecure modification vulnerability in the /etc/passwd file was found in the container openshift/jenkins. An attacker with access to the CVE-2019-193527.0An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/presto as shipped in Red Hat Openshift 4.CVE-2019-193537.0An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hive as shipped in Red Hat Openshift 4. A CVE-2019-193547.8An insecure modification vulnerability in the /etc/passwd file was found in the operator-framework/hadoop as shipped in Red Hat Openshift 4.CVE-2019-193557.0An insecure modification vulnerability in the /etc/passwd file was found in the openshift/ocp-release-operator-sdk. An attacker with access CVE-2019-193567.5Netis WF2419 is vulnerable to authenticated Remote Code Execution (RCE) as root through the router Web management page. The vulnerability ha CVE-2019-19367.2A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Ci CVE-2019-193626.5An issue was discovered in the Chat functionality of the TeamViewer desktop application 14.3.4730 on Windows. (The vendor states that it was CVE-2019-193637.8An issue was discovered in Ricoh (including Savin and Lanier) Windows printer drivers prior to 2020 that allows attackers local privilege es CVE-2019-193647.8A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019 CVE-2019-193666.1A cross-site scripting (XSS) vulnerability in app/xml_cdr/xml_cdr_search.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary CVE-2019-193676.1A cross-site scripting (XSS) vulnerability in app/fax/fax_files.php in FusionPBX 4.4.1 allows remote attackers to inject arbitrary web scrip