CVEvulnerability

CVE-2018-10861

8.1 HIGH Published 2018-07-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-07-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.1 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVSS 2.0 ([email protected])
5.5 MEDIUM — AV:N/AC:L/Au:S/C:N/I:P/A:P
Weaknesses
CWE-285, CWE-287

Description

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.

Affected configurations

• ceph ceph 10.2.0 • ceph ceph 10.2.1 • ceph ceph 10.2.2 • ceph ceph 10.2.3 • ceph ceph 10.2.4 • ceph ceph 10.2.5 • ceph ceph 10.2.6 • ceph ceph 10.2.7 • ceph ceph 10.2.8 • ceph ceph 10.2.9 • ceph ceph 10.2.10 • ceph ceph 10.2.11 • ceph ceph 12.2.0 • ceph ceph 12.2.1 • ceph ceph 12.2.2 • ceph ceph 12.2.3 • ceph ceph 12.2.4 • ceph ceph 12.2.5 • ceph ceph 12.2.6 • ceph ceph 12.2.7 • ceph ceph 13.2.0 • ceph ceph 13.2.1 • redhat ceph storage 3 • redhat ceph storage mon 2 • redhat ceph storage mon 3 • redhat ceph storage osd 2 • redhat ceph storage osd 3 • redhat enterprise linux desktop 7.0 • redhat enterprise linux server 7.0 • redhat enterprise linux workstation 7.0 • opensuse leap 15.0 • debian debian linux 9.0

Related

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-287 Improper Authentication weakness

References