VDB
CVE-2018-1088
CVE-2018-1088
PUBLISHED
CVSS 8.100000381469727 HIGH
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
EPSS 5.49% · 92.5th percentile
Risk Scores
CVSS 3.1
8.100000381469727
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
5.49%
92.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:Pro:18.04:LTS | glusterfs | 0, 3.11.2-1, 3.12.2-1 |
| Ubuntu:Pro:16.04:LTS | glusterfs | 0, 3.7.3-1ubuntu1, 3.7.3-1ubuntu2 |
Timeline
- Apr 18, 2018 CVE Published
- Apr 14, 2021 EPSS Score
- Aug 25, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 28, 2021 EPSS Score
- Mar 1, 2022 EPSS Score
- May 3, 2022 EPSS Score
- Sep 7, 2022 EPSS Score
- Jan 10, 2023 EPSS Score
- Feb 3, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 16, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2018-1088 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1558721 third-party-advisory
- https://ubuntu.com/security/notices/USN-4770-1 vendor-advisory
- https://www.cve.org/CVERecord?id=CVE-2018-1088 third-party-advisory