Critical severity · published Apr 22, 2019
CVE-2019-3899
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse
9.8
CVSS
1.4%
EPSS
No
On KEV
Description
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only affects heketi as shipped with Openshift Container Platform 3.11.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HE
Heketi · Heketi Project
All versions, or not specified · source: NVD
OC
Openshift Container Platform · Redhat
3.11 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-3899
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-3899
Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3255
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3899
More from Heketi
8.8
CVE-2017-15103
A security-check flaw was found in the way the Heketi 5 server API handled user requests
7.8
CVE-2017-15104
An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable
5.5
CVE-2020-10763
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information