Every CVE Search/ Get API key

CVE-2019-3816

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure...

7.5 HighFix available

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

14.7%Up 11.6 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Record
CVE-2019-3816
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
EUVDEUVD-2019-13439 7.5

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Record
EUVD-2019-13439
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-966p-p7cq-2frr 7.5

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure...

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Record
GHSA-966p-p7cq-2frr
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
NVD 7.5

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Record
CVE-2019-3816
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-22
Updated
2026-11-02
OSVAZL-36969 7.5

CVE-2019-3816 affecting package openwsman for versions less than 2.6.8-13

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Record
AZL-36969
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-05
OSVAZL-37151 7.5

CVE-2019-3816 affecting package openwsman for versions less than 2.6.8-13

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Record
AZL-37151
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 9 moreShow less
OSV 7.5

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Record
CVE-2019-3816
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2019:0638 7.5

Red Hat Security Advisory: openwsman security update

Record
RHSA-2019:0638
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVRHSA-2019:0972 7.5

Red Hat Security Advisory: openwsman security update

Record
RHSA-2019:0972
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2019-3816 7.5

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Record
UBUNTU-CVE-2019-3816
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVopenSUSE-SU-2019:1111-1 No score

Security update for openwsman

This update for openwsman fixes the following issues:

Security issues fixed:

  • CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure (bsc#1122623).
  • CVE-2019-3833: Fixed a vulnerability in process_connection() which could allow an attacker to trigger an infinite loop which leads to Denial of Service (bsc#1122623).

Other issues addressed:

  • Added OpenSSL 1.1 compatibility
  • Compilation in debug mode fixed
  • Directory listing without authentication fixed (bsc#1092206).

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:1111-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:11130-1 No score

libwsman-devel-2.7.0-2.10 on GA media

These are all security issues fixed in the libwsman-devel-2.7.0-2.10 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11130-1
Updated
2026-11-02
OSVSUSE-SU-2019:0654-1 No score

Security update for openwsman

This update for openwsman fixes the following issues:

Security issues fixed:

  • CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure (bsc#1122623).
  • CVE-2019-3833: Fixed a vulnerability in process_connection() which could allow an attacker to trigger an infinite loop which leads to Denial of Service (bsc#1122623).

Other issues addressed:

  • Added OpenSSL 1.1 compatibility
  • Compilation in debug mode fixed
  • Directory listing without authentication fixed (bsc#1092206).
Record
SUSE-SU-2019:0654-1
Updated
2026-11-02
OSVSUSE-SU-2019:0656-1 No score

Security update for openwsman

This update for openwsman fixes the following issues:

Security issues fixed:

  • CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure (bsc#1122623).
  • CVE-2019-3833: Fixed a vulnerability in process_connection() which could allow an attacker to trigger an infinite loop which leads to Denial of Service (bsc#1122623).
Record
SUSE-SU-2019:0656-1
Updated
2026-11-02
OSVSUSE-SU-2019:13981-1 No score

Security update for openwsman

This update for openwsman fixes the following issues:

Security issues fixed:

  • CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure (bsc#1122623).
  • CVE-2019-3833: Fixed a vulnerability in process_connection() which could allow an attacker to trigger an infinite loop which leads to Denial of Service (bsc#1122623).
Record
SUSE-SU-2019:13981-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
openwsman
Azure Linux:3
 before 2.6.8-13
2.6.8-13
openwsman
Azure Linux:2
 before 2.6.8-13
2.6.8-13
libwsman1
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-client
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-server
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
libwsman-devel
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-perl
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-python
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
Show 71 moreShow less
Affected packages
PackageAffectedFixed
openwsman-ruby
Red Hat:enterprise_linux:7::client
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
libwsman1
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-client
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-python
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-server
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
libwsman-devel
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-perl
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-ruby
Red Hat:enterprise_linux:7::computenode
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
libwsman1
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-client
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-python
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-server
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
libwsman-devel
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-perl
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-ruby
Red Hat:enterprise_linux:7::server
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
libwsman1
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-client
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-python
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-server
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
libwsman-devel
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-perl
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
openwsman-ruby
Red Hat:enterprise_linux:7::workstation
 before 0:2.6.3-6.git4391e5c.el7_6
0:2.6.3-6.git4391e5c.el7_6
libwsman1
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
libwsman1-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-client
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-client-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-debugsource
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-perl-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-python3
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-python3-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-server
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-server-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
rubygem-openwsman-debuginfo
Red Hat:enterprise_linux:8::appstream
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
libwsman-devel
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
libwsman1-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-client-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-debugsource
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-perl-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-python3-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman-server-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
rubygem-openwsman-debuginfo
Red Hat:enterprise_linux:8::crb
 before 0:2.6.5-5.el8
0:2.6.5-5.el8
openwsman
SUSE:Linux Enterprise Module for Server Applications 15
From an advisory covering 2 CVEs
 before 2.6.7-3.3.1
2.6.7-3.3.1
openwsman
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 2 CVEs
 before 2.4.11-21.8.1
2.4.11-21.8.1
openwsman
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 2 CVEs
 before 2.4.11-21.8.1
2.4.11-21.8.1
openwsman
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 2 CVEs
 before 2.4.11-21.8.1
2.4.11-21.8.1
openwsman
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 2 CVEs
 before 2.4.11-21.8.1
2.4.11-21.8.1
openwsman
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 2 CVEs
 before 2.4.11-21.8.1
2.4.11-21.8.1
openwsman
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 2 CVEs
 before 2.4.11-21.8.1
2.4.11-21.8.1
openwsman
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 2 CVEs
 before 2.4.11-21.8.1
2.4.11-21.8.1
openwsman
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 2 CVEs
 before 2.4.11-21.8.1
2.4.11-21.8.1
openwsman
SUSE:Linux Enterprise Software Development Kit 11 SP4
From an advisory covering 2 CVEs
 before 2.2.3-0.16.8.1
2.2.3-0.16.8.1
openwsman
SUSE:Linux Enterprise Server 11 SP4
From an advisory covering 2 CVEs
 before 2.2.3-0.16.8.1
2.2.3-0.16.8.1
openwsman
SUSE:Linux Enterprise Server for SAP Applications 11 SP4
From an advisory covering 2 CVEs
 before 2.2.3-0.16.8.1
2.2.3-0.16.8.1
openwsman
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.7-0ubuntu2
 None known
openwsman
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.4.7-0ubuntu22.6.5-0ubuntu3
 None known
openwsman
Ubuntu:20.04:LTS
 All versions, plus listed versions
2.6.5-0ubuntu32.6.5-0ubuntu5
 None known
openwsman
Ubuntu:22.04:LTS
 All versions, plus listed versions
2.6.5-0ubuntu52.6.5-0ubuntu6
 None known
openwsman
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.6.5-0ubuntu82.6.5-0ubuntu102.6.5-0ubuntu112.6.5-0ubuntu122.6.5-0ubuntu15
 None known
openwsman
Ubuntu:25.10
 All versions, plus listed versions
2.6.5-0ubuntu152.6.5-0ubuntu16
 None known
openwsman
Ubuntu:26.10
 All versions, plus listed versions
2.6.5-0ubuntu162.8.1-0ubuntu1
 None known
openwsman
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.6.5-0ubuntu16
 None known
openwsman
openSUSE:Leap 15.0
From an advisory covering 2 CVEs
 before 2.6.7-lp150.2.3.1
2.6.7-lp150.2.3.1

History

History
RecordedChangedSources
affected
factsOSV
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-3816 is a high vulnerability (CVSS 7.5) in [unknown] Openwsman, published March 14, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 14.7%, the 96th percentile. Fixed in openwsman 2.6.8-13.

References

Show 26 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open