Heketi Arbitrary Code Execution
A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2017-15103US | high8.8 | — | ||
A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, r… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2017:3481WEB
- https://access.redhat.com/security/cve/CVE-2017-15103WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=1510147WEB
- https://github.com/heketi/heketiPACKAGE
- https://github.com/heketi/heketi/commit/787bae461b23003a4daa4d1d639016a754cf6b00WEB
- https://github.com/heketi/heketi/releases/tag/v5.0.1WEB
- https://nvd.nist.gov/vuln/detail/CVE-2017-15103ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan