High severity · published Dec 18, 2017
CVE-2017-15104
An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable
7.8
CVSS
0.4%
EPSS
No
On KEV
Description
An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
7.0 · source: NVD
HE
Heketi · Heketi Project
5.0.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-15104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-15104
Third Party Advisory
https://access.redhat.com/errata/RHSA-2017:3481
Third Party Advisory
https://access.redhat.com/security/cve/CVE-2017-15104
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1510149
Release Notes
https://github.com/heketi/heketi/releases/tag/v5.0.1
More from Heketi
9.8
CVE-2019-3899
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse
8.8
CVE-2017-15103
A security-check flaw was found in the way the Heketi 5 server API handled user requests
5.5
CVE-2020-10763
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information