CWE Code: 275
Vulnerability Type: privilege_escalation
CVSS Score: 5.5
CWE Name:  Permission Issues
Summary: it was discovered that in the ovirt's rest api before version 4.3.2.1, removediskcommand is triggered as an internal command, meaning the permission validation that should be performed against the calling user is skipped. a user with low privileges (eg basic operations) could exploit this flaw to delete disks attached to guests.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/PARTIAL
Published Date: 2019-03-25
Last Modified Date: 2019-10-09