← Back

CVE-2019-3899

nvd nist
Published: Apr 22, 2019Modified: Jun 17, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.

Affected (2)

Redhat
1 product
Openshift Container Platform
Heketi Project
1 product
Heketi
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Openshift Container Platform
Version 3.11
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Heketi
All versions

Related CWEs

CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-592
DEPRECATED: Authentication Bypass Issues
This weakness has been deprecated because it covered redundant concepts already described in CWE-287.

References (4)

Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Issue TrackingMitigationThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingMitigationThird Party Advisory

Timeline

No history available yet.