What is CVE-2019-15876?

CVE-2019-15876 is a medium-severity vulnerability in Freebsd, classified under Missing Authorization. CVSS score: 5.5/10. Published 2020-04-28.

How severe is CVE-2019-15876?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Auth bypass in Freebsd

CVE-2019-15876

In FreeBSD 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, and 11.3-RELEASE before 11.3-RELEASE-p7, driver specific ioctl command handlers in the oce network driver failed to check whether the caller has sufficient privileges allowing unprivileged users to send passthrough commands to the device firmware.

Vulnerability class: Broken Access Control

EPSS: 0.003 (19.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.

Affected products

Freebsd — versions 11.3, 12.1
N/a Freebsd — versions 12.1-STABLE before r356089, 12.1-RELEASE before 12.1-RELEASE-p3, 11.3-STABLE before r356090, 11.3-RELEASE before 11.3-RELEASE-p7

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

secteam@freebsd.org (x_refsource_CONFIRM, Patch, Vendor Advisory)

Frequently asked questions

What is CVE-2019-15876?: CVE-2019-15876 is a medium-severity vulnerability in Freebsd, classified under Missing Authorization. CVSS score: 5.5/10. Published 2020-04-28.
How severe is CVE-2019-15876?: Medium severity. CVSS v3 base score is 5.5 out of 10.