Vulnerability CVE-2019-3899

Vulnerability CVE-2019-3899

Published: 2019-04-22

Description:

It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.

Type:

CWE-287

(Improper Authentication)

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
7.5/10	6.4/10	10/10

Exploit range	Attack complexity	Authentication
Remote	Low	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Redhat -> Openshift container platform
Heketi project -> Heketi

References:

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3899

Copyright 2024, cxsecurity.com