CVE-2018-1112 HIGH

CVE-2018-1112

Vendor Unspecified
Product glusterfs
Weakness CWE-287 · Improper authentication
Published April 25, 2018
Last update August 5, 2024
View on NVD All CVEs

CVSS base score

8.0/10
Attack vector Adjacent
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality High
Integrity High

CVSS vector

CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Key dates

02Disclosure timeline

April 25, 2018 CVE published
August 5, 2024 Record updated