VulnerabilityModified
CVE-2017-15103
An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.
HIGH 8.8EPSS 5.50%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.
- CVSS 3.0
- 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.50% probability · 92th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78, CWE-20
- Affected
- heketi project/heketi · redhat/enterprise linux
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2017:3481Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2017-15103Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1510147Issue Tracking, Patch
- https://access.redhat.com/errata/RHSA-2017:3481Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2017-15103Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1510147Issue Tracking, Patch
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.