CVE-2018-14654CWE-22

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator

Medium · published October 31, 2018

CVSS v3.0
5.4
EPSS
3%
Percentile
85.4
In the wild
Unconfirmed
What it is

The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GF_XATTROP_ENTRY_IN_KEY' xattrop to create arbitrary, empty files on the target server.

The record
Technical detail
CVSS v3.0
5.4 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.02630 · 85.4th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2018-10-31T19:00Z
EPSS history
Timeline
  • 31 OCT 19:00Z
    The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator
    cvelistv5