CVE-2018-10926 — Improper Input Validation in Glusterfs
CWE-20 — Improper Input ValidationCWE-22 — Path TraversalCWE-59 — Link Following11 documents8 sources
Severity
8.8HIGHNVD
EPSS
1.4%
top 19.59%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 4
Latest updateMay 13
Description
A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages6 packages
Also affects: Debian Linux 8.0, 9.0, Enterprise Linux 6.0, 7.0
🔴Vulnerability Details
3GHSA▶
GHSA-pjmw-qwj2-f9fg: A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server↗2022-05-13
CVEList▶
CVE-2018-10926: A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server↗2018-09-04
OSV▶
CVE-2018-10926: A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server↗2018-09-04
📋Vendor Advisories
4Debian▶
CVE-2018-10926: glusterfs - A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs serv...↗2018
💬Community
3Bugzilla
▶
Bugzilla▶
CVE-2018-10926 glusterfs: Device files can be created in arbitrary locations [fedora-all]↗2018-09-04