{"id":"CVE-2018-14651","published":"2018-10-31T21:00:00Z","modified":"2024-08-05T09:38:12Z","title":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was…","vendor":null,"product":"glusterfs","tier":"tail","description":{"text":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete. A remote, authenticated attacker could use one of these flaws to execute arbitrary code, create arbitrary files, or cause denial of service on glusterfs server nodes via symlinks to relative paths.","provenance":"source","from":"CVE.org"},"cvss":{"score":8.8,"severity":"HIGH","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.03225,"percentile":0.88197,"provenance":"source"},"cwes":[{"id":"CWE-59","name":"Improper Link Resolution Before File Access"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-14651","tags":["x_refsource_CONFIRM"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3431","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/11/msg00003.html","tags":["mailing-list","x_refsource_MLIST"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3432","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://security.gentoo.org/glsa/201904-06","tags":["vendor-advisory","x_refsource_GENTOO"]}],"priority":{"score":23.8,"factors":[{"name":"EPSS percentile","points":17.64},{"name":"CVSS severity","points":6.16}]},"euvd":{"id":"EUVD-2018-6549","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-red-hat-glusterfs-cve-2018-10926","parents":[{"from":"CVE-2018-10926","to":"CVE-2018-14651","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.","from":"CVE.org","in":"CVE-2018-14651"}]},{"from":"CVE-2018-10927","to":"CVE-2018-14651","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.","from":"CVE.org","in":"CVE-2018-14651"}]},{"from":"CVE-2018-10928","to":"CVE-2018-14651","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.","from":"CVE.org","in":"CVE-2018-14651"}]},{"from":"CVE-2018-10929","to":"CVE-2018-14651","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.","from":"CVE.org","in":"CVE-2018-14651"}]},{"from":"CVE-2018-10930","to":"CVE-2018-14651","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-10926 was incomplete.","from":"CVE.org","in":"CVE-2018-14651"}]}]}}