CVE-2018-1112CWE-287

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from…

High · published April 25, 2018

CVSS v3.0
8.0
EPSS
2%
Percentile
83.5
In the wild
Unconfirmed
What it is

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

The record
Technical detail
CVSS v3.0
8.0 · HIGH
Vector
CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02347 · 83.5th percentile
Weakness
CWE-287 · Improper Authentication
Published
2018-04-25T12:00Z
EPSS history
Timeline
  • 25 APR 12:00Z
    glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from…
    cvelistv5