CVE-2017-15103CWE-78

A security-check flaw was found in the way the Heketi 5 server API handled user requests

published December 18, 2017

CVSS
—
EPSS
5%
Percentile
92.8
In the wild
Unconfirmed
What it is

A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05495 · 92.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2017-12-18T19:00Z
EPSS history
Timeline
  • 18 DEC 19:00Z
    A security-check flaw was found in the way the Heketi 5 server API handled user requests
    cvelistv5