Vulnerabilities > CVE-2019-3879 - Missing Authorization vulnerability in multiple products

CVSS 8.1 - HIGH

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

LOW

Confidentiality impact

NONE

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

ovirt

redhat

CWE-862

NVD

Published: 2019-03-25

Updated: 2020-10-19

Summary

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.

Vulnerable Configurations

Part	Description	Count
Application	Ovirt Ovirt Ovirt - Ovirt Ovirt 3.0.0 Ovirt Ovirt 3.0.0_0001 Ovirt Ovirt 3.1.0 Ovirt Ovirt 3.2.0 Ovirt Ovirt 3.2.0-4 Ovirt Ovirt 3.2.1 Ovirt Ovirt 3.2.1-1 Ovirt Ovirt 3.2.2 Ovirt Ovirt 3.3 Ovirt Ovirt 3.3.0 Ovirt Ovirt 3.3.0.1 Ovirt Ovirt 3.3.1 Ovirt Ovirt 3.3.2 Ovirt Ovirt 3.3.3 Ovirt Ovirt 3.3.4 Ovirt Ovirt 3.3.5 Ovirt Ovirt 3.4.0 Ovirt Ovirt 3.4.1 Ovirt Ovirt 3.4.2 Ovirt Ovirt 3.4.3 Ovirt Ovirt 3.4.4 Ovirt Ovirt 3.5.0 Ovirt Ovirt 3.5.0.1 Ovirt Ovirt 3.5.1 Ovirt Ovirt 3.5.1.1 Ovirt Ovirt 3.5.2 Ovirt Ovirt 3.5.2.1 Ovirt Ovirt 3.5.3 Ovirt Ovirt 3.5.3.1 Ovirt Ovirt 3.5.4 Ovirt Ovirt 3.5.4.1 Ovirt Ovirt 3.5.4.2 Ovirt Ovirt 3.5.5 Ovirt Ovirt 3.5.6 Ovirt Ovirt 3.5.6.1 Ovirt Ovirt 3.5.6.2 Ovirt Ovirt 3.5.7 Ovirt Ovirt 3.5.7.1 Ovirt Ovirt 3.5.8 Ovirt Ovirt 3.6.0 Ovirt Ovirt 3.6.0-1 Ovirt Ovirt 3.6.0.1 Ovirt Ovirt 3.6.0.1-2 Ovirt Ovirt 3.6.0.2 Ovirt Ovirt 3.6.0.3 Ovirt Ovirt 3.6.1 Ovirt Ovirt 3.6.1.1 Ovirt Ovirt 3.6.1.2 Ovirt Ovirt 3.6.1.3 Ovirt Ovirt 3.6.2 Ovirt Ovirt 3.6.2.1 Ovirt Ovirt 3.6.2.2 Ovirt Ovirt 3.6.2.3 Ovirt Ovirt 3.6.2.4 Ovirt Ovirt 3.6.2.5 Ovirt Ovirt 3.6.2.6 Ovirt Ovirt 3.6.3 Ovirt Ovirt 3.6.3.1 Ovirt Ovirt 3.6.3.2 Ovirt Ovirt 3.6.3.3 Ovirt Ovirt 3.6.3.4 Ovirt Ovirt 3.6.4 Ovirt Ovirt 3.6.4.1 Ovirt Ovirt 3.6.5 Ovirt Ovirt 3.6.5.1 Ovirt Ovirt 3.6.5.2 Ovirt Ovirt 3.6.5.3 Ovirt Ovirt 3.6.6 Ovirt Ovirt 3.6.6.1 Ovirt Ovirt 3.6.6.2 Ovirt Ovirt 3.6.7 Ovirt Ovirt 3.6.7.1 Ovirt Ovirt 3.6.7.2 Ovirt Ovirt 3.6.7.3 Ovirt Ovirt 3.6.7.4 Ovirt Ovirt 3.6.7.5 Ovirt Ovirt 3.6.8 Ovirt Ovirt 3.6.8.1 Ovirt Ovirt 3.6.9 Ovirt Ovirt 3.6.9.1 Ovirt Ovirt 3.6.9.2 Ovirt Ovirt 3.6.10 Ovirt Ovirt 3.6.10.1 Ovirt Ovirt 3.6.10.2 Ovirt Ovirt 3.6.11 Ovirt Ovirt 3.6.11.1 Ovirt Ovirt 3.6.11.2 Ovirt Ovirt 3.6.11.3 Ovirt Ovirt 3.6.12 Ovirt Ovirt 3.6.12.1 Ovirt Ovirt 3.6.12.2 Ovirt Ovirt 3.6.12.3 Ovirt Ovirt 3.6.13 Ovirt Ovirt 3.6.13.1 Ovirt Ovirt 3.6.13.2 Ovirt Ovirt 3.6.13.3 Ovirt Ovirt 3.6.13.4 Ovirt Ovirt 3.6.13.5 Ovirt Ovirt 4-0.7.2 Ovirt Ovirt 4.0.0 Ovirt Ovirt 4.0.0.1 Ovirt Ovirt 4.0.0.2 Ovirt Ovirt 4.0.0.3 Ovirt Ovirt 4.0.0.4 Ovirt Ovirt 4.0.0.5 Ovirt Ovirt 4.0.0.6 Ovirt Ovirt 4.0.1 Ovirt Ovirt 4.0.1.1 Ovirt Ovirt 4.0.2 Ovirt Ovirt 4.0.2.1 Ovirt Ovirt 4.0.2.2 Ovirt Ovirt 4.0.2.3 Ovirt Ovirt 4.0.2.4 Ovirt Ovirt 4.0.2.5 Ovirt Ovirt 4.0.2.6 Ovirt Ovirt 4.0.2.7 Ovirt Ovirt 4.0.3 Ovirt Ovirt 4.0.4 Ovirt Ovirt 4.0.4.1 Ovirt Ovirt 4.0.4.2 Ovirt Ovirt 4.0.4.3 Ovirt Ovirt 4.0.4.4 Ovirt Ovirt 4.0.5 Ovirt Ovirt 4.0.5.1 Ovirt Ovirt 4.0.5.2 Ovirt Ovirt 4.0.5.3 Ovirt Ovirt 4.0.5.4 Ovirt Ovirt 4.0.5.5 Ovirt Ovirt 4.0.6 Ovirt Ovirt 4.0.6.1 Ovirt Ovirt 4.0.6.2 Ovirt Ovirt 4.0.6.3 Ovirt Ovirt 4.0.7 Ovirt Ovirt 4.0.7.1 Ovirt Ovirt 4.0.7.2 Ovirt Ovirt 4.0.7.3 Ovirt Ovirt 4.0.7.4 Ovirt Ovirt 4.0.7.5 Ovirt Ovirt 4.1.0 Ovirt Ovirt 4.1.0.1 Ovirt Ovirt 4.1.0.2 Ovirt Ovirt 4.1.0.3 Ovirt Ovirt 4.1.0.4 Ovirt Ovirt 4.1.1 Ovirt Ovirt 4.1.1.1 Ovirt Ovirt 4.1.1.2 Ovirt Ovirt 4.1.1.3 Ovirt Ovirt 4.1.1.4 Ovirt Ovirt 4.1.1.5 Ovirt Ovirt 4.1.1.6 Ovirt Ovirt 4.1.1.7 Ovirt Ovirt 4.1.1.8 Ovirt Ovirt 4.1.2 Ovirt Ovirt 4.1.2.1 Ovirt Ovirt 4.1.2.2 Ovirt Ovirt 4.1.2.3 Ovirt Ovirt 4.1.3 Ovirt Ovirt 4.1.3.1 Ovirt Ovirt 4.1.3.2 Ovirt Ovirt 4.1.3.3 Ovirt Ovirt 4.1.3.4 Ovirt Ovirt 4.1.3.5 Ovirt Ovirt 4.1.4 Ovirt Ovirt 4.1.4.1 Ovirt Ovirt 4.1.4.2 Ovirt Ovirt 4.1.5 Ovirt Ovirt 4.1.5.1 Ovirt Ovirt 4.1.5.2 Ovirt Ovirt 4.1.6 Ovirt Ovirt 4.1.6.1 Ovirt Ovirt 4.1.6.2 Ovirt Ovirt 4.1.7 Ovirt Ovirt 4.1.7.1 Ovirt Ovirt 4.1.7.2 Ovirt Ovirt 4.1.7.3 Ovirt Ovirt 4.1.7.4 Ovirt Ovirt 4.1.7.5 Ovirt Ovirt 4.1.7.6 Ovirt Ovirt 4.1.8 Ovirt Ovirt 4.1.8.1 Ovirt Ovirt 4.1.8.2 Ovirt Ovirt 4.1.9 Ovirt Ovirt 4.1.9.1 Ovirt Ovirt 4.1.9.2 Ovirt Ovirt 4.1.10 Ovirt Ovirt 4.1.10.1 Ovirt Ovirt 4.1.10.2 Ovirt Ovirt 4.1.10.3 Ovirt Ovirt 4.1.10.4 Ovirt Ovirt 4.1.11 Ovirt Ovirt 4.1.11.1 Ovirt Ovirt 4.1.11.2 Ovirt Ovirt 4.2.0 Ovirt Ovirt 4.2.0.1 Ovirt Ovirt 4.2.0.2 Ovirt Ovirt 4.2.1 Ovirt Ovirt 4.2.1.1 Ovirt Ovirt 4.2.1.2 Ovirt Ovirt 4.2.1.3 Ovirt Ovirt 4.2.1.4 Ovirt Ovirt 4.2.1.5 Ovirt Ovirt 4.2.1.6 Ovirt Ovirt 4.2.1.7 Ovirt Ovirt 4.2.2 Ovirt Ovirt 4.2.2.1 Ovirt Ovirt 4.2.2.2 Ovirt Ovirt 4.2.2.3 Ovirt Ovirt 4.2.2.4 Ovirt Ovirt 4.2.2.5 Ovirt Ovirt 4.2.2.6 Ovirt Ovirt 4.2.3 Ovirt Ovirt 4.2.3.1 Ovirt Ovirt 4.2.3.2 Ovirt Ovirt 4.2.3.3 Ovirt Ovirt 4.2.3.4 Ovirt Ovirt 4.2.3.5 Ovirt Ovirt 4.2.3.6 Ovirt Ovirt 4.2.3.7 Ovirt Ovirt 4.2.3.8 Ovirt Ovirt 4.2.4 Ovirt Ovirt 4.2.4.1 Ovirt Ovirt 4.2.4.2 Ovirt Ovirt 4.2.4.3 Ovirt Ovirt 4.2.4.4 Ovirt Ovirt 4.2.4.5 Ovirt Ovirt 4.2.5 Ovirt Ovirt 4.2.5.1 Ovirt Ovirt 4.2.5.2 Ovirt Ovirt 4.2.5.3 Ovirt Ovirt 4.2.5.4 Ovirt Ovirt 4.2.6 Ovirt Ovirt 4.2.6.1 Ovirt Ovirt 4.2.6.2 Ovirt Ovirt 4.2.6.3 Ovirt Ovirt 4.2.6.4 Ovirt Ovirt 4.2.7 Ovirt Ovirt 4.2.7.1 Ovirt Ovirt 4.2.7.2 Ovirt Ovirt 4.2.7.3 Ovirt Ovirt 4.2.7.4 Ovirt Ovirt 4.2.7.5 Ovirt Ovirt 4.2.8 Ovirt Ovirt 4.2.8.1 Ovirt Ovirt 4.2.8.2 Ovirt Ovirt 4.2.8.3 Ovirt Ovirt 4.2.8.4 Ovirt Ovirt 4.2.8.5 Ovirt Ovirt 4.3.0 Ovirt Ovirt 4.3.0.1 Ovirt Ovirt 4.3.0.2 Ovirt Ovirt 4.3.0.3 Ovirt Ovirt 4.3.0.4 Ovirt Ovirt 4.3.1 Ovirt Ovirt 4.3.1.1 Ovirt Ovirt 4.3.2	324
OS	Redhat Redhat Virtualization 4.2	1

Common Weakness Enumeration (CWE)

CWE-862 - Missing Authorization

Redhat

advisories

rhsa

id	RHBA-2019:0802

rpms

ovirt-engine-0:4.2.8.7-0.1.el7ev
ovirt-engine-backend-0:4.2.8.7-0.1.el7ev
ovirt-engine-dbscripts-0:4.2.8.7-0.1.el7ev
ovirt-engine-extensions-api-impl-0:4.2.8.7-0.1.el7ev
ovirt-engine-extensions-api-impl-javadoc-0:4.2.8.7-0.1.el7ev
ovirt-engine-health-check-bundler-0:4.2.8.7-0.1.el7ev
ovirt-engine-lib-0:4.2.8.7-0.1.el7ev
ovirt-engine-restapi-0:4.2.8.7-0.1.el7ev
ovirt-engine-setup-0:4.2.8.7-0.1.el7ev
ovirt-engine-setup-base-0:4.2.8.7-0.1.el7ev
ovirt-engine-setup-plugin-ovirt-engine-0:4.2.8.7-0.1.el7ev
ovirt-engine-setup-plugin-ovirt-engine-common-0:4.2.8.7-0.1.el7ev
ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.2.8.7-0.1.el7ev
ovirt-engine-setup-plugin-websocket-proxy-0:4.2.8.7-0.1.el7ev
ovirt-engine-tools-0:4.2.8.7-0.1.el7ev
ovirt-engine-tools-backup-0:4.2.8.7-0.1.el7ev
ovirt-engine-vmconsole-proxy-helper-0:4.2.8.7-0.1.el7ev
ovirt-engine-webadmin-portal-0:4.2.8.7-0.1.el7ev
ovirt-engine-websocket-proxy-0:4.2.8.7-0.1.el7ev
rhvm-0:4.2.8.7-0.1.el7ev

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

Redhat

References