{"id":"CVE-2018-10929","published":"2018-09-04T16:00:00Z","modified":"2024-08-05T07:54:35Z","title":"A flaw was found in RPC request using gfs2_create_req in glusterfs server","vendor":"Red Hat","product":"glusterfs","tier":"tail","description":{"text":"A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute arbitrary code on glusterfs server nodes.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0338,"percentile":0.88735,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2607","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10929","tags":["x_refsource_CONFIRM"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/09/msg00021.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2018:2608","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3470","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://www.securityfocus.com/bid/107577","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://security.gentoo.org/glsa/201904-06","tags":["vendor-advisory","x_refsource_GENTOO"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/11/msg00000.html","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":23.9,"factors":[{"name":"EPSS percentile","points":17.75},{"name":"CVSS severity","points":6.16}]},"vendorSlug":"red-hat","euvd":{"id":"EUVD-2018-2983","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-glusterfs-cve-2018-10926","children":[{"from":"CVE-2018-10929","to":"CVE-2018-14651","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.","from":"CVE.org","in":"CVE-2018-14651"}]}]}}