CVE-2020-10763 : An information-disclosure flaw was found in the way Heketi before 10.1.0 logs se

An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.

Published 2020-11-24 17:15:11

Updated 2020-12-02 19:16:59

Source Red Hat, Inc.

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2020-10763

Redhat » Enterprise Linux » Version: 7.0
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Matching versions
Redhat » Gluster Storage » Version: 3.0
cpe:2.3:a:redhat:gluster_storage:3.0:*:*:*:*:*:*:*
Matching versions
Redhat » Gluster Storage » Version: 3.5
cpe:2.3:a:redhat:gluster_storage:3.5:*:*:*:*:*:*:*
Matching versions
Redhat » Openshift Container Platform » Version: 4.0
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
Matching versions
Heketi Project » Heketi
Versions before (<) 10.1.0
cpe:2.3:a:heketi_project:heketi:*:*:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2020-10763

Top countries where our scanners detected CVE-2020-10763

Top open port discovered on systems with this issue 53

IPs affected by CVE-2020-10763 636,251

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2020-10763!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2020-10763

EPSS FAQ

0.04%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 6 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-10763

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2020-10763

CWE-532 Insertion of Sensitive Information into Log File

The product writes sensitive information to a log file.
Assigned by:
- nvd@nist.gov (Primary)
- secalert@redhat.com (Secondary)

References for CVE-2020-10763

https://bugzilla.redhat.com/show_bug.cgi?id=1845387

1845387 – (CVE-2020-10763) CVE-2020-10763 heketi: gluster-block volume password details available in logs
Issue Tracking;Third Party Advisory
https://github.com/heketi/heketi/releases/tag/v10.1.0

Release Release 10.1 · heketi/heketi · GitHub
Release Notes;Third Party Advisory