VULNERABILITY INTELLIGENCE

CVE-2019-3899

CVSS score9.8 CRITICAL
EPSS probability1.41%
CISA KEVNot currently listed
Published2019-04-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.

Weakness classification

  • CWE-306: Missing Authentication for Critical Function
  • CWE-592: DEPRECATED: Authentication Bypass Issues

Primary references