Auth bypass in Heketi_project Heketi
CVE-2019-3899
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.
EPSS: 0.014 (69.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Heketi_project Heketi
- The Heketi Project — versions heketi 6 as shipped with Openshift Container Platform 3.11
- Redhat Openshift_container_platform — versions 3.11
Weakness classification (CWE)
References
- secalert@redhat.com (x_refsource_CONFIRM, Third Party Advisory, Mitigation, Issue Tracking)
- secalert@redhat.com (x_refsource_REDHAT, vendor-advisory, Third Party Advisory)
Frequently asked questions
- What is CVE-2019-3899?
- CVE-2019-3899 is a critical-severity vulnerability in Heketi_project Heketi, classified under CWE-592. CVSS score: 9.8/10. Published 2019-04-22.
- How severe is CVE-2019-3899?
- Critical severity. CVSS v3 base score is 9.8 out of 10.