CVE-2019-3816: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 14.7% chance of exploitation in the next 30 days.

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Affected products

• Fedoraproject Fedora: version 28 only; version 29 only; version 30 only
• Opensuse Leap: version 15.0 only; version 42.3 only
• Openwsman Project Openwsman: up to and including 2.6.9
• Red Hat Enterprise Linux: version 8.0 only
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Eus: version 8.1 only; version 8.2 only; version 8.4 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.6 only; version 8.2 only; version 8.4 only
• Red Hat Enterprise Linux Server Eus: version 7.6 only
• Red Hat Enterprise Linux Server Tus: version 7.6 only; version 8.2 only; version 8.4 only
• Red Hat Enterprise Linux Workstation: version 7.0 only

Published 2019-03-14. Last modified 2026-06-17.