CVE-2019-3816

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

• CWE-22
• CWE-22

• http://bugzilla.suse.com/show_bug.cgi?id=1122623Issue Tracking, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107368Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/107409Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:0638Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0972Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3816Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V5HJ355RSKMFQ7GRJAHRZNDVXASF7TA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2HEZ7D7GF3HDF36JLGYXIK5URR66DS4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXQP7UDPRZIZ4LM7FEJCTC2EDUYVOR2J/
• http://bugzilla.suse.com/show_bug.cgi?id=1122623Issue Tracking, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00006.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00065.htmlMailing List, Third Party Advisory
• http://www.securityfocus.com/bid/107368Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/107409Third Party Advisory, VDB Entry
• https://access.redhat.com/errata/RHSA-2019:0638Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:0972Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3816Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V5HJ355RSKMFQ7GRJAHRZNDVXASF7TA/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B2HEZ7D7GF3HDF36JLGYXIK5URR66DS4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CXQP7UDPRZIZ4LM7FEJCTC2EDUYVOR2J/

Published

Mar 14, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-3810A flaw was found in moodle versions 3.6 to 3.6.1, 3.5 to 3.5…6.1
• CVE-2019-3811A vulnerability was found in sssd. If a user was configured …5.2
• CVE-2019-3812QEMU, through version 2.10 and through version 3.1.0, is vul…4.4
• CVE-2019-3813Spice, versions 0.5.2 through 0.14.1, are vulnerable to an o…7.5
• CVE-2019-3814It was discovered that Dovecot before versions 2.2.36.1 and …7.7
• CVE-2019-3815A memory leak was discovered in the backport of fixes for CV…3.3
• CVE-2019-3817A use-after-free flaw has been discovered in libcomps before…7.5
• CVE-2019-3818The kube-rbac-proxy container before version 0.4.1 as used i…7.5
• CVE-2019-3819A flaw was found in the Linux kernel in the function hid_deb…4.4
• CVE-2019-3820It was discovered that the gnome-shell lock screen since ver…4.3
• CVE-2019-3821A flaw was found in the way civetweb frontend was handling r…7.5
• CVE-2019-3822libcurl versions from 7.36.0 to before 7.64.0 are vulnerable…9.8