CVE-2019-3816

moderate-risk

Published 2019-03-14

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Do I need to act?

0.74% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

NETWORK / LOW complexity

Affected Products (20)

Openwsman

Enterprise Linux

Enterprise Linux Desktop

Enterprise Linux Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Server Tus

Enterprise Linux Workstation

Fedora

Leap

Affected Vendors

Redhat Fedoraproject Opensuse Openwsman Project

References (22)

Issue Tracking http://bugzilla.suse.com/show_bug.cgi?id=1122623

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.html

Third Party Advisory http://www.securityfocus.com/bid/107368

Third Party Advisory http://www.securityfocus.com/bid/107409

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0638

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0972

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3816

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Issue Tracking http://bugzilla.suse.com/show_bug.cgi?id=1122623

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.html

Mailing List http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.html

Third Party Advisory http://www.securityfocus.com/bid/107368

Third Party Advisory http://www.securityfocus.com/bid/107409

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0638

Third Party Advisory https://access.redhat.com/errata/RHSA-2019:0972

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3816

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

and 2 more references

/ 100

moderate-risk

Severity 26/34 · High

Exploitability 2/34 · Minimal

Exposure 20/34 · Moderate