Medium severity · published Nov 24, 2020
CVE-2020-10763
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information
5.5
CVSS
0.4%
EPSS
No
On KEV
Description
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
7.0 · source: NVD
GS
Gluster Storage · Redhat
3.0; 3.5 · source: NVD
HE
Heketi · Heketi Project
before 10.1.0 · source: NVD
OC
Openshift Container Platform · Redhat
4.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-10763
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-10763
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=1845387
Release Notes
https://github.com/heketi/heketi/releases/tag/v10.1.0
More from Heketi
9.8
CVE-2019-3899
It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse
8.8
CVE-2017-15103
A security-check flaw was found in the way the Heketi 5 server API handled user requests
7.8
CVE-2017-15104
An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable