CVE Feed

    Dashboard / CVE / CVE-2015-5242

    CVE-2015-5242

    OpenStack Swift-on-File (aka Swiftonfile) does not properly restrict use of the pickle Python module when loading metadata, which allows remote authenticated users to execute arbitrary code via a crafted extended attribute (xattrs).

    Published:Oct 20, 2015
    Last Modified:Apr 12, 2025
    EPS:Nov 25, 2015
    EPSS Score:0.01202
    CVSS Score:6

    Affected Products

    Vendor
    Redhat
    Product
    Gluster Storage
    Vendor
    Redhat
    Product
    Storage

    Exploits

    No exploit reference

    Related CVEs

    CVE-2021-44142 (CVSS 8.8) — The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility wit…
    CVE-2020-25717 (CVSS 8.1) — A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this f…
    CVE-2016-2124 (CVSS 5.9) — A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve…
    CVE-2020-10763 (CVSS 5.5) — An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw…
    CVE-2019-3880 (CVSS 5.4) — A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An u…
    CVE-2019-3831 (CVSS 6.7) — A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run…
    CVE-2018-14654 (CVSS 6.5) — The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A rem…
    CVE-2018-14653 (CVSS 8.8) — The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '…
    CVE-2018-14652 (CVSS 6.5) — The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/in…
    CVE-2018-10928 (CVSS 8.8) — A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations t…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High