CVE-2018-10841CWE-288
glusterfs is vulnerable to privilege escalation on gluster server nodes
Medium · published June 20, 2018
What it is
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
The record
Technical detail
- CVSS v3.0
- 6.6 · MEDIUM
- Vector
- CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.01230 · 68.7th percentile
- Weakness
- CWE-288 · Authentication Bypass Using an Alternate Path or Channel
- Published
- 2018-06-20T18:00Z
EPSS history
Timeline