High severity · published Apr 18, 2018
CVE-2018-1088
A privilege escalation flaw was found in gluster 3.x snapshot scheduler
8.1
CVSS
5.5%
EPSS
No
On KEV
Description
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)5.5% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
9.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0; 7.0 · source: NVD
GS
Gluster Storage · Redhat
3.0 through 3.13.2 · source: NVD
LE
Leap · Opensuse
15.1 · source: NVD
VI
Virtualization · Redhat
4.0 · source: NVD
VH
Virtualization Host · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-1088
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-1088
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00035.html
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1136
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1137
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1275
Vendor Advisory
https://access.redhat.com/errata/RHSA-2018:1524
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1558721
More from Debian Linux
10.0
CVE-2025-32433
Erlang/OTP SSH Vulnerable to Pre-Authentication RCE
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
10.0
CVE-2015-3306
ProFTPD Improper Access Control Vulnerability
9.8
CVE-2026-24061
GNU InetUtils Argument Injection Vulnerability