CVE-2017-15103

Опубликовано: 18 дек. 2017

Источник: nvd

CVSS3: 8.8

CVSS2: 9

EPSS Низкий

Описание

A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.

Ссылки

https://access.redhat.com/errata/RHSA-2017:3481
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2017-15103
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1510147
Issue Tracking
Patch
https://access.redhat.com/errata/RHSA-2017:3481
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2017-15103
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1510147
Issue Tracking
Patch

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:heketi_project:heketi:5.0:*:*:*:*:*:*:*

Конфигурация 2

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

EPSS

Процентиль: 77%

0.01019

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-78

CWE-20

Связанные уязвимости

CVE-2017-15103

CVSS3: 8.8

redhat

около 8 лет назад

CVE-2017-15103

CVSS3: 8.8

debian

около 8 лет назад

A security-check flaw was found in the way the Heketi 5 server API han ...

GHSA-6g56-v9qg-jp92

CVSS3: 8.8

github

почти 2 года назад

Heketi Arbitrary Code Execution

EPSS

Процентиль: 77%

0.01019

Низкий

8.8 High

CVSS3

9 Critical

CVSS2

Дефекты

CWE-78

CWE-20