PT-2019-16751 · Ovirt · Ovirt

Publicado 2019-03-25 · Atualizado 2020-10-19 · CVE-2019-3879

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions oVirt versions prior to 4.3.2.1

Description A flaw was discovered in oVirt's REST API where the RemoveDiskCommand is triggered as an internal command, bypassing permission validation against the calling user. This allows a user with low privileges, such as Basic Operations, to delete disks attached to guests.

Recommendations For versions prior to 4.3.2.1, update to version 4.3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the RemoveDiskCommand to minimize the risk of exploitation.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2019-3879

Produtos afetados

Ovirt

Referências · 5

• https://osv.dev/vulnerability/CVE-2019-3879 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-3879 · Nota de Segurança
• https://access.redhat.com/errata/RHBA-2019:0802 · Aviso do Fabricante
• http://securityfocus.com/bid/107561 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879 · Nota