PT-2018-10187

CVE-2018-10926

Published

2018-09-04

Updated

2022-04-12

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions glusterfs server (affected versions not specified)

Description A flaw was found in RPC request using gfs3 mknod req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Impacts

Researchers

Michael Hanselmann

Sam Fowler

Vendors

Affected products

Weakness enumeration

CWE-20: Improper Input Validation

CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')

Related identifiers

CVE-2018-10926