CVE-2019-3886

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on the guest agent, which could lead to potentially disclosing unintended information or denial of service by causing libvirt to block.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Apr 4, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-38875.6A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. InCVE-2019-38889.8A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because CVE-2019-38895.4A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterprisCVE-2019-38908.1It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get confCVE-2019-38917.8It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the CanCVE-2019-38934.9In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the CVE-2019-38948.8It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run thCVE-2019-38958.0An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An aCVE-2019-38967.8A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw fCVE-2019-38975.3It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know itCVE-2019-38999.8It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misusCVE-2019-39007.7An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packet
CVE-2019-3886: Medium severity, CVSS 5.4 | Vulnix