High severity8.1NVD Advisory· Published Mar 25, 2019· Updated Jun 17, 2026
CVE-2019-3879
CVE-2019-3879
Description
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- unspecified/ovirt-enginev5Range: 4.3.2.1
Patches
Vulnerability mechanics
References
3- www.securityfocus.com/bid/107561nvdThird Party AdvisoryVDB Entry
- access.redhat.com/errata/RHBA-2019:0802nvdThird Party Advisory
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
News mentions
0No linked articles in our index yet.