Vulnerability in Libvirt
CVE-2019-10166
It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would permit them to modify managed save state files. If a managed sa…
EPSS: 0.005 (37.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Libvirt — versions 4.x.x before 4.10.1, 5.x.x before 5.4.1
- Redhat Enterprise_linux — versions 7.0, 8.0
- Redhat Enterprise_linux_desktop — versions 6.0, 7.0
- Redhat Enterprise_linux_server — versions 6.0, 7.0
- Redhat Enterprise_linux_server_aus — versions 7.6
- Redhat Enterprise_linux_server_eus — versions 7.6
- Redhat Enterprise_linux_server_tus — versions 7.6
- Redhat Enterprise_linux_workstation — versions 6.0, 7.0
- Redhat Libvirt
- Redhat Virtualization — versions 4.3
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)
- secalert@redhat.com (x_refsource_CONFIRM, Issue Tracking, Vendor Advisory)
- secalert@redhat.com (vendor-advisory, Third Party Advisory, x_refsource_GENTOO)
Frequently asked questions
- What is CVE-2019-10166?
- CVE-2019-10166 is a high-severity vulnerability in Libvirt, classified under Improper Access Control. CVSS score: 7.8/10. Published 2019-08-02.
- How severe is CVE-2019-10166?
- High severity. CVSS v3 base score is 7.8 out of 10.