CVE-2019-3897

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-552

Affected software

No affected versions have been published.

Timeline

Published
Mar 16, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-38999.8It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misusCVE-2019-39007.7An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packetCVE-2019-39014.7A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particulaCVE-2019-39025.9A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and CVE-2019-390510.0Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.CVE-2019-39068.8Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can useCVE-2019-39077.5Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash ofCVE-2019-39087.5Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An aCVE-2019-39099.8Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor interventioCVE-2019-39109.1Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated CVE-2019-39116.1Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remoCVE-2019-39126.1An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unaut
CVE-2019-3897: Medium severity, CVSS 5.3 | Vulnix