PT-2018-10440

CVE-2018-1127

Published

2018-09-11

Updated

2019-10-09

Description by

CVSS 3.1

8.1

High

MetricsAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Red Hat Gluster Storage versions prior to 3.4.0

Description The issue allows attackers to replay session tokens and authenticate as the target user. This can occur when session tokens remain active for a few minutes after a user logs out, enabling attackers to use tokens acquired via sniffing or man-in-the-middle (MITM) attacks.

Recommendations For versions prior to 3.4.0, update to version 3.4.0 or later to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Sidhax

Vendors

Affected products

Weakness enumeration

CWE-384: Session Fixation

CWE-613: Insufficient Session Expiration

Related identifiers