CVE-2019-3831

CWE-863 — Incorrect Authorization6 documents5 sources
Severity
6.7MEDIUM
EPSS
0.1%
top 73.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Ovirt Vdsm[unknown] VdsmRedhat Gluster Storage
Timeline
PublishedMar 25
Latest updateMay 13

Description

A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run function exposed to the vdsm system user could be abused to execute arbitrary commands as root.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages3 packages

▶NVDovirt/vdsm4.19 — 4.30.3+1
▶CVEListV5[unknown]/vdsm4.30.9

Patches

Patch: bugzilla.redhat.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-mgfj-qcpq-xx99: A vulnerability was discovered in vdsm, version 4↗2022-05-13
▶
CVEList
CVE-2019-3831: A vulnerability was discovered in vdsm, version 4↗2019-03-25
▶

📋Vendor Advisories

1
Red Hat
vdsm: privilege escalation to root via systemd_run↗2019-02-14
▶

💬Community

2
Bugzilla
CVE-2019-3831 vdsm: privilege escalation to root via systemd_run [fedora-all]↗2019-02-14
▶
Bugzilla
CVE-2019-3831 vdsm: privilege escalation to root via systemd_run↗2019-02-14
▶