CVE-2019-3899

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-592CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Apr 22, 2019
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-39007.7An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packetCVE-2019-39014.7A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevant locks (in particulaCVE-2019-39025.9A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and CVE-2019-390510.0Zoho ManageEngine ADSelfService Plus 5.x before build 5703 has SSRF.CVE-2019-39068.8Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can useCVE-2019-39077.5Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash ofCVE-2019-39087.5Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An aCVE-2019-39099.8Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor interventioCVE-2019-39109.1Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated CVE-2019-39116.1Reflected cross-site scripting (XSS) vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 allows an unauthenticated remoCVE-2019-39126.1An open redirect vulnerability in LabKey Server Community Edition before 18.3.0-61806.763 via the /__r1/ returnURL parameter allows an unautCVE-2019-39134.9Command manipulation in LabKey Server Community Edition before 18.3.0-61806.763 allows an authenticated remote attacker to unmount any drive
CVE-2019-3899: Critical severity, CVSS 9.8 | Vulnix