CVE-2019-3879

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-03-25 · updated 2026-06-17
Weakness: CWE-862

Description

It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.

Affected products

[UNKNOWN] ovirt-engine: before 4.3.2.1 — fixed in 4.3.2.1
RedHat Virtualization: 4.2

How to fix

Upgrade to a fixed version: [UNKNOWN] ovirt-engine 4.3.2.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/107561
https://access.redhat.com/errata/RHBA-2019:0802
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879
http://www.securityfocus.com/bid/107561
https://access.redhat.com/errata/RHBA-2019:0802
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3879

Get alerted when CVE-2019-3879 or the next vulnerability affects your stack