CVE-2017-15104

lowpriority · track · 31EPSS 0.004 · 37 %ileEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
0.43% (37th) EPSS
CVSS 2.1 · low
Is it mine?
9 products
Check your exposure
Who says so?
5 sources
cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-28

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • Fixedheketi-0:5.0.0-19.el7rhgs.src as a component of Red Hat Gluster Storage Server 3.3 on RHEL-7redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2017:3481
  • Fixedheketi-0:5.0.0-19.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.3 on RHEL-7redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2017:3481
  • Fixedheketi-client-0:5.0.0-19.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.3 on RHEL-7redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2017:3481
  • Fixedpython-heketi-0:5.0.0-19.el7rhgs.x86_64 as a component of Red Hat Gluster Storage Server 3.3 on RHEL-7redhat_csaf

    For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

    https://access.redhat.com/errata/RHSA-2017:3481
02

cvss

Technical severity, 0–10. One row per scoring source.

7.8
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–high · 2.1–7.8

v2.02.1lowAV:L/AC:L/Au:N/C:P/I:N/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 2.9
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9
v3.05.5mediumCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:Nsecondary · Red Hat Product Security US
v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV
v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-200USCWE-552USCWE-552USCWE-552US
04

affected products (9)

Products and version ranges known to be affected.

05

advisories (3)

Vendor and ecosystem advisories describing this.

  • RHSA-2017:3481Red Hat Security Advisory: heketi security update2017-12-18csaf · redhat_csafUS

    An update for heketi is now available for Red Hat Gluster Storage 3.3 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  • GHSA-q9vw-wr57-xjv3Information Exposure in Heketi2022-02-15ghsa · osvUS

    An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.

  • GO-2022-0866Information Exposure in Heketi in github.com/heketi/heketi2024-08-21vendor · osvUS

    Information Exposure in Heketi in github.com/heketi/heketi

06

also known as (5)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdosvnvdredhat_csafNVDCVE.orgMITRE
published 2017-12-18modified 2026-06-17
08

references (12)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan