CVE-2018-10841

CVSS V2 Medium 6.5 CVSS V3 High 8.8
Description
glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
Overview
  • CVE ID
  • CVE-2018-10841
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2018-06-20T18:29:00
  • Last Modified Date
  • 2023-02-12T23:31:27
Weakness Enumerations
CWE URL
CWE-288 http://cwe.mitre.org/data/definitions/288.html
NVD-CWE-noinfo http://cwe.mitre.org/data/definitions/NVD-noinfo.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:a:gluster:glusterfs:*:*:*:*:*:*:*:* 1 OR 4.1.8
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* 1 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:N/AC:L/Au:S/C:P/I:P/A:P
  • Access Vector
  • NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • PARTIAL
  • Integrity Impact
  • PARTIAL
  • Availability Impact
  • PARTIAL
  • Base Score
  • 6.5
  • Severity
  • MEDIUM
  • Exploitability Score
  • 8
  • Impact Score
  • 6.4
CVSS Version 3
  • Version
  • 3.1
  • Vector String
  • CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  • Attack Vector
  • NETWORK
  • Attack Compatibility
  • LOW
  • Privileges Required
  • LOW
  • User Interaction
  • NONE
  • Scope
  • UNCHANGED
  • Confidentiality Impact
  • HIGH
  • Availability Impact
  • HIGH
  • Base Score
  • 8.8
  • Base Severity
  • HIGH
  • Exploitability Score
  • 2.8
  • Impact Score
  • 5.9
References
Reference URL Reference Tags
https://access.redhat.com/errata/RHSA-2018:1954 Third Party Advisory
https://access.redhat.com/errata/RHSA-2018:1955 Third Party Advisory
https://access.redhat.com/security/cve/CVE-2018-10841
https://bugzilla.redhat.com/show_bug.cgi?id=1582043
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10841 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html Mailing List Third Party Advisory
https://review.gluster.org/#/c/20328/ Patch Third Party Advisory
https://security.gentoo.org/glsa/201904-06 Third Party Advisory
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2018-10841
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-10841
History
Created Old Value New Value Data Type Notes
2022-05-10 06:41:13 Added to TrackCVE
2022-12-03 08:16:49 2018-06-20T18:29Z 2018-06-20T18:29:00 CVE Published Date updated
2022-12-03 08:16:49 2021-12-15T16:46:18 CVE Modified Date updated
2022-12-03 08:16:49 Analyzed Vulnerability Status updated
2023-02-02 17:07:41 2023-02-02T15:17:27 CVE Modified Date updated
2023-02-02 17:07:41 Analyzed Modified Vulnerability Status updated
2023-02-02 17:07:42 Weakness Enumeration update
2023-02-02 17:07:42 glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes. A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes. Description updated
2023-02-02 17:07:43 References updated
2023-02-13 00:07:59 2023-02-12T23:31:27 CVE Modified Date updated
2023-02-13 00:08:00 Weakness Enumeration update
2023-02-13 00:08:00 A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes. glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes. Description updated