Information disclosure in OpenWSMAN - CVE-2019-3816

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU18313

Information disclosure in OpenWSMAN - CVE-2019-3816

Published: April 18, 2019


Vulnerability identifier: #VU18313
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-3816
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to incorrect default configuration of the application due to the working directory of openwsmand daemon was set to root directory. A remote unauthenticated attacker can use the API to view contents of arbitrary file on the system.


Affected software

OpenWSMAN
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Opensuse
Fedora
openwsman

How to mitigate CVE-2019-3816

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

openwsman - addressed in versions 2.6.5-4.fc28, 2.6.5-9.fc29, 2.6.8-5.fc30

External References

Related Security Bulletins