← Back

CVE-2018-10861

nvd nist
Published: Jul 10, 2018Modified: Nov 21, 2024

JSON object

Loading...
8.1
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Exploitability: 2.8 / Impact: 5.2
Source: NVD

Description

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.

Affected (32)

Show all products
Ceph: Ceph · Redhat: Ceph Storage, Ceph Storage Mon, Ceph Storage Osd, Enterprise Linux Desktop, Enterprise Linux Server, Enterprise Linux Workstation · Opensuse: Leap · Debian: Debian Linux
Ceph
1 product
Ceph
Redhat
6 products
Ceph Storage
Ceph Storage Mon
Ceph Storage Osd
Enterprise Linux Desktop
Enterprise Linux Server
Enterprise Linux Workstation
Opensuse
1 product
Leap
Debian
1 product
Debian Linux
Configuration A
22 vulnerable
Vulnerable SoftwareAffected Versions
Ceph
Ceph
Version 10.2.0
Ceph
Version 10.2.10
Ceph
Version 10.2.11
Ceph
Version 10.2.1
Ceph
Version 10.2.2
Ceph
Version 10.2.3
Ceph
Version 10.2.4
Ceph
Version 10.2.5
Ceph
Version 10.2.6
Ceph
Version 10.2.7
Ceph
Version 10.2.8
Ceph
Version 10.2.9
Ceph
Version 12.2.0
Ceph
Version 12.2.1
Ceph
Version 12.2.2
Ceph
Version 12.2.3
Ceph
Version 12.2.4
Ceph
Version 12.2.5
Ceph
Version 12.2.6
Ceph
Version 12.2.7
Ceph
Version 13.2.0
Ceph
Version 13.2.1
Configuration B
8 vulnerable
Vulnerable SoftwareAffected Versions
Ceph Storage
Version 3
Redhat
Ceph Storage Mon
Version 2
Ceph Storage Mon
Version 3
Redhat
Ceph Storage Osd
Version 2
Ceph Storage Osd
Version 3
Enterprise Linux Desktop
Version 7.0
Enterprise Linux Server
Version 7.0
Enterprise Linux Workstation
Version 7.0
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
Leap
Version 15.0
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 9.0

Related CWEs

CWE-285
Improper Authorization
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-287
Improper Authentication
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (20)

Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Issue TrackingVendor Advisory
Source: secalert@redhat.com
Third Party AdvisoryVDB Entry
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: secalert@redhat.com
Issue TrackingPatchThird Party Advisory
Source: secalert@redhat.com
PatchThird Party Advisory
Source: secalert@redhat.com
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.