CVE-2018-10841CWE-288

glusterfs is vulnerable to privilege escalation on gluster server nodes

Medium · published June 20, 2018

CVSS v3.0
6.6
EPSS
1%
Percentile
68.7
In the wild
Unconfirmed
What it is

glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.

The record
Technical detail
CVSS v3.0
6.6 · MEDIUM
Vector
CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01230 · 68.7th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2018-06-20T18:00Z
EPSS history
Timeline
  • 20 JUN 18:00Z
    glusterfs is vulnerable to privilege escalation on gluster server nodes
    cvelistv5