CVE-2019-3895

HighCVSS 8.0/10Last modified Jun 17, 2026

Description

An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image.

Metrics

CVSS 3.1 8.0/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Jun 3, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38967.8A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw f CVE-2019-38975.3It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know it CVE-2019-38999.8It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misus CVE-2019-39007.7An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packet CVE-2019-39014.7A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particula CVE-2019-39025.9A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and CVE-2019-390510.0Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.CVE-2019-39068.8Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use CVE-2019-39077.5Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of CVE-2019-39087.5Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An a CVE-2019-39099.8Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor interventio CVE-2019-39109.1Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated