← Vulnerability feed

Vulnerability record · CVE-2019-3897 · published 16 March 2021

CVE-2019-3897: Redhat certification vulnerability

Redhat · Certification

It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue.

5.3 CVSS 3.1 Medium EPSS 0.91% · top 41.6% CWE-552 · CWE-552
5.3CVSS 3.1 base score, v2 5.0
0.91%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

It has been discovered in redhat-certification that any unauthorized user may download any file under /var/www/rhcert, provided they know its name. Red Hat Certification 6 and 7 is vulnerable to this issue.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://bugzilla.redhat.com/show_bug.cgi?id=1593768 Issue TrackingVendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1593768 Issue TrackingVendor Advisory

Track CVE-2019-3897 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2018-10870Redhat certification path traversal vulnerabilityredhat-certification does not properly sanitize paths in rhcertStore.py:__saveResultsFile. A remote attacker could use this flaw to overwrite any fil…EPSS 6.1%9.1CVE-2018-10866Redhat certification missing authorization vulnerabilityIt was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated use…EPSS 1.0%9.1CVE-2018-10867Redhat certification vulnerabilityFiles are accessible without restrictions from the /update/results page of redhat-certification 7 package, allowing an attacker to remove any file ac…EPSS 1.1%7.5CVE-2018-10863Redhat certification vulnerabilityIt was discovered that redhat-certification 7 is not properly configured and it lists all files and directories in the /var/www/rhcert/store/transfer…EPSS 1.1%7.5CVE-2018-10865Redhat certification missing authorization vulnerabilityIt was discovered that the /configuration view of redhat-certification 7 does not perform an authorization check and it allows an unauthenticated use…EPSS 1.0%7.5CVE-2018-10868Redhat certification uncontrolled resource consumption vulnerabilityredhat-certification 7 does not properly restrict the number of recursive definitions of entities in XML documents, allowing an unauthenticated user …EPSS 1.1%7.5CVE-2018-10869Redhat certification incorrect permission assignment vulnerabilityredhat-certification does not properly restrict files that can be download through the /download page. A remote attacker may download any file access…EPSS 2.7%6.2CVE-2018-10864Redhat certification uncontrolled resource consumption vulnerabilityAn uncontrolled resource consumption flaw has been discovered in redhat-certification in the way documents are loaded. A remote attacker may provide …EPSS 1.2%

Source: NIST National Vulnerability Database (record CVE-2019-3897), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.