PatchTheCVECVE-2019-3879: It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an in
CVE-2019-3879 is a high-severity flaw (CVSS 8.1) affecting ovirt, virtualization. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low privileges (eg Basic Operations) could exploit this flaw to delete disks attached to guests.
Why this priority
- High severity
- On your watchlist
A fixed release or distro patch exists.
Risk facts
| CVSS score | 8.1 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 1.8% (top 21%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2019-03-25 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2019-3879?
ovirt: upgrade to 4.3.2.1; virtualization: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2019-3879 being exploited?
CVE-2019-3879 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2019-3879 affect?
CVE-2019-3879 affects ovirt, virtualization. Severity is high (CVSS 8.1). It was discovered that in the ovirt's REST API before version 4.3.2.1, RemoveDiskCommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. A user with low pr
How urgent is CVE-2019-3879?
Priority 53/100. High severity; On your watchlist
Related CVEs
- CVE-2019-10194 MEDIUM 5.5 MITIGATE DOWNGRADE Sensitive passwords used in deployment and configuration of oVirt Metrics, all versions
- CVE-2018-1075 MEDIUM 5.0 UPGRADE ovirt-engine up to version 4.2.3 is vulnerable to an unfiltered password when choosing manual db provisioning
- CVE-2018-1074 HIGH 7.7 UPGRADE DOWNGRADE ovirt-engine API and administration web portal before versions 4.2.2.5, 4.1.11.2 is vulnerable to an exposure
- CVE-2018-1072 MEDIUM 5.0 UPGRADE DOWNGRADE ovirt-engine before version ovirt 4.2.2 is vulnerable to an information exposure through log files
- CVE-2017-15113 HIGH 7.2 UPGRADE DOWNGRADE ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without mas