{"id":"CVE-2018-10926","published":"2018-09-04T15:00:00Z","modified":"2024-08-05T07:54:35Z","title":"A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server","vendor":"Red Hat","product":"glusterfs","tier":"tail","description":{"text":"A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an arbitrary location via path traversal and execute arbitrary code on a glusterfs server node.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.1,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02579,"percentile":0.85155,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2607","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10926","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00021.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2608","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3470","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://security.gentoo.org/glsa/201904-06","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":22.7,"factors":[{"name":"EPSS percentile","points":17.03},{"name":"CVSS severity","points":5.67}]},"vendorSlug":"red-hat","euvd":{"id":"EUVD-2018-2980","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-glusterfs-cve-2018-10926","children":[{"from":"CVE-2018-10926","to":"CVE-2018-14651","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.","from":"CVE.org","in":"CVE-2018-14651"}]}]}}