CVE-2019-3879

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
unspecified	ovirt-engine	4.3.2.1

References

http://www.securityfocus.com/bid/107561Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:0802Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879Issue Tracking, Third Party Advisory
http://www.securityfocus.com/bid/107561Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHBA-2019:0802Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879Issue Tracking, Third Party Advisory

Timeline

Published: Mar 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38805.4A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use CVE-2019-38817.8Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations unde CVE-2019-38825.5A flaw was found in the Linux kernel's vfio interface implementation that permits violation of the user's locked memory limit. If a device i CVE-2019-38837.5In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'iobloc CVE-2019-38845.4A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from anoth CVE-2019-38857.5A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be lea CVE-2019-38865.4An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on th CVE-2019-38875.6A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In CVE-2019-38889.8A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because CVE-2019-38895.4A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterpris CVE-2019-38908.1It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get conf CVE-2019-38917.8It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Can