PT-2019-16751 · Ovirt · Ovirt

Published 2019-03-25 · Updated 2020-10-19 · CVE-2019-3879

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions oVirt versions prior to 4.3.2.1

Description A flaw was discovered in oVirt's REST API where the RemoveDiskCommand is triggered as an internal command, bypassing permission validation against the calling user. This allows a user with low privileges, such as Basic Operations, to delete disks attached to guests.

Recommendations For versions prior to 4.3.2.1, update to version 4.3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the RemoveDiskCommand to minimize the risk of exploitation.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2019-3879

Affected Products

Ovirt

References · 5

• https://osv.dev/vulnerability/CVE-2019-3879 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3879 · Security Note
• https://access.redhat.com/errata/RHBA-2019:0802 · Vendor Advisory
• http://securityfocus.com/bid/107561 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879 · Note