CVE-2018-17954 — Vulnetix

CVE-2018-17954 PUBLISHED CVSS 9.300000190734863 CRITICAL

An Improper Privilege Management in crowbar of SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud 9, SUSE OpenStack Cloud Crowbar 8, SUSE OpenStack Cloud Crowbar 9 allows root users on any crowbar managed node to cause become root on any other node. This issue affects: SUSE OpenStack Cloud 7 crowbar-core versions prior to 4.0+git.1578392992.fabfd186c-9.63.1, crowbar-. SUSE OpenStack Cloud 8 ardana-cinder versions prior to 8.0+git.1579279939.ee7da88-3.39.3, ardana-. SUSE OpenStack Cloud 9 ardana-ansible versions prior to 9.0+git.1581611758.f694f7d-3.16.1, ardana-. SUSE OpenStack Cloud Crowbar 8 crowbar-core versions prior to 5.0+git.1582968668.1a55c77c5-3.35.4, crowbar-. SUSE OpenStack Cloud Crowbar 9 crowbar-core versions prior to 6.0+git.1582892022.cbd70e833-3.19.3, crowbar-.

EPSS 0.04% · 13.1th percentile

Risk Scores

CVSS 3.1

9.300000190734863

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS Score

0.04%

13.1th percentile

Affected Products

Vendor	Product	Versions
SUSE	SUSE OpenStack Cloud Crowbar 9	crowbar-core
suse	openstack_cloud	8.0, 9.0, 7.0
SUSE	SUSE OpenStack Cloud 8	ardana-cinder
SUSE	SUSE OpenStack Cloud 7	crowbar-core
suse	openstack_cloud_crowbar	9.0, 8.0
SUSE	SUSE OpenStack Cloud 9	*
SUSE	SUSE OpenStack Cloud Crowbar 8	*

Exploit Intelligence

CIRCL seen: CVE-2018-17954 (circl-sighting)
https://bugzilla.suse.com/show_bug.cgi?id=1117080 (circl)

Timeline

Apr 3, 2020 CVE Published
Apr 3, 2020 PoC Published
Apr 14, 2021 EPSS Score
Jun 23, 2021 EPSS Score
Aug 24, 2021 EPSS Score
Oct 26, 2021 EPSS Score
Dec 27, 2021 EPSS Score
Feb 28, 2022 EPSS Score
May 2, 2022 EPSS Score
Jul 3, 2022 EPSS Score
Sep 5, 2022 EPSS Score
Nov 6, 2022 EPSS Score

References

Open in Interactive Console →