CVE Feed

    Dashboard / CVE / CVE-2018-1127

    CVE-2018-1127

    Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.

    Published:May 8, 2018
    Last Modified:Nov 21, 2024
    EPS:Sep 11, 2018
    EPSS Score:0.00545
    CVSS Score:4.2

    Affected Products

    Vendor
    Redhat
    Product
    Gluster Storage
    Vendor
    Redhat
    Product
    Storage

    Exploits

    No exploit reference

    Related CVEs

    CVE-2021-44142 (CVSS 8.8) — The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility wit…
    CVE-2020-25717 (CVSS 8.1) — A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this f…
    CVE-2016-2124 (CVSS 5.9) — A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve…
    CVE-2020-10763 (CVSS 5.5) — An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw…
    CVE-2019-3880 (CVSS 5.4) — A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An u…
    CVE-2019-3831 (CVSS 6.7) — A vulnerability was discovered in vdsm, version 4.19 through 4.30.3 and 4.30.5 through 4.30.8. The systemd_run…
    CVE-2018-14654 (CVSS 6.5) — The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A rem…
    CVE-2018-14653 (CVSS 8.8) — The Gluster file system through versions 4.1.4 and 3.12 is vulnerable to a heap-based buffer overflow in the '…
    CVE-2018-14652 (CVSS 6.5) — The Gluster file system through versions 3.12 and 4.1.4 is vulnerable to a buffer overflow in the 'features/in…
    CVE-2018-10928 (CVSS 8.8) — A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations t…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High