Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
githubGitHub Advisory DatabaseGHSA-6G56-V9QG-JP92
HistoryApr 24, 2024 - 9:35 p.m.

Heketi Arbitrary Code Execution

2024-04-2421:35:47
CWE-20
CWE-78
CWE-94
GitHub Advisory Database
github.com
13
heketi
server api
security flaw
remote code execution
privilege escalation

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.6%

JSON

A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.

Affected configurations

Vulners
Node
heketi_projectheketiRange<5.0.1
CPENameOperatorVersion
github.com/heketi/heketilt5.0.1

Related

prion 1
nvd 1
osv 3
veracode 2
cvelist 1
cve 1
nessus 3
fedora 2
openvas 2
redhat 1
redhatcve 1
prion
prion
Privilege escalation
2017-12-18 19:29:00
nvd
nvd
CVE-2017-15103
2017-12-18 19:29:00
osv
osv
Heketi Arbitrary Code Execution
2024-04-24 21:35:47
CVE-2017-15103
2017-12-18 19:29:00
Heketi Arbitrary Code Execution in github.com/heketi/heketi
2024-06-04 15:19:21
veracode
veracode
Remote Code Execution (RCE)
2019-01-15 09:21:23
Remote Code Execution (RCE)
2017-12-19 08:55:05
cvelist
cvelist
CVE-2017-15103
2017-12-18 19:00:00
cve
cve
CVE-2017-15103
2017-12-18 19:29:00
nessus
nessus
RHEL 7 : heketi (RHSA-2017:3481)
2017-12-21 00:00:00
Fedora 26 : heketi (2017-f7cbe22fd8)
2018-01-11 00:00:00
Fedora 27 : heketi (2017-01ad8b3946)
2018-01-15 00:00:00
fedora
fedora
[SECURITY] Fedora 27 Update: heketi-5.0.1-1.fc27
2018-01-10 22:39:22
[SECURITY] Fedora 26 Update: heketi-5.0.1-1.fc26
2018-01-10 22:23:58
openvas
openvas
Fedora Update for heketi FEDORA-2017-f7cbe22fd8
2018-01-11 00:00:00
Fedora Update for heketi FEDORA-2017-01ad8b3946
2018-01-11 00:00:00
redhat
redhat
(RHSA-2017:3481) Important: heketi security update
2017-12-18 17:14:51
redhatcve
redhatcve
CVE-2017-15103
2017-12-18 17:16:19

9 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.004 Low

EPSS

Percentile

73.6%

JSON
Related for GHSA-6G56-V9QG-JP92
prion1nvd1osv3veracode2cvelist1cve1nessus3fedora2openvas2redhat1redhatcve1