CVE-2018-1069

low-risk

Published 2018-03-09

Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and GroupId for GlusterFS and NFS to read and write any data on the network filesystem.

Do I need to act?

0.09% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.1/10 High

ADJACENT_NETWORK / HIGH complexity

Affected Products (1)

Openshift

Affected Vendors

Redhat

References (4)

Third Party Advisory http://www.securityfocus.com/bid/103364

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1552987

Third Party Advisory http://www.securityfocus.com/bid/103364

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1552987

/ 100

low-risk

Severity 18/34 · Moderate

Exploitability 0/34 · Minimal

Exposure 5/34 · Minimal