CVE-2019-3899

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-04-22 · updated 2026-06-17
Weakness: CWE-592

Description

It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.

Affected products

Heketi Project Heketi: all versions
Red Hat OpenShift Container Platform 4.18: 3.11

References

https://access.redhat.com/errata/RHSA-2019:3255
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3899
https://access.redhat.com/errata/RHSA-2019:3255
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3899

Get alerted when CVE-2019-3899 or the next vulnerability affects your stack