glusterfs is vulnerable to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to trusted storage pool, start, stop, and delete volumes.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 6.6
- CVSS 3.0 Vector: (CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade glusterfs-server | Aug 28, 2019 | Jun 20, 2018 |
| Debian | — | Upgrade glusterfs | Nov 29, 2021 | Jun 20, 2018 |
| Gentoo Linux | — | Upgrade sys-cluster/glusterfs. | Apr 3, 2019 | Jun 20, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade glusterfs-fuseUpgrade glusterfs-libsUpgrade glusterfsUpgrade glusterfs-rdmaUpgrade glusterfs-client-xlatorsUpgrade glusterfs-api | Aug 10, 2018 | Jun 20, 2018 |
| Redhat_linux | — | Upgrade glusterfs-server | Jun 21, 2018 | Jun 20, 2018 |
| Ubuntu | — | Upgrade glusterfs-common (Ubuntu Pro)Upgrade glusterfs-client (Ubuntu Pro)Upgrade glusterfs-server (Ubuntu Pro) | Mar 22, 2023 | Jun 20, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub