CVE-2018-16947

An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not require (or allow for) authentication of those RPCs. Handling those RPCs results in operations being performed with administrator credentials, including dumping/restoring volume contents and manipulating the backup database. For example, an unauthenticated attacker can replace any volume's content with arbitrary data.

• CWE-287

• http://openafs.org/pages/security/OPENAFS-SA-2018-001.txtVendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00024.htmlThird Party Advisory
• https://www.debian.org/security/2018/dsa-4302Third Party Advisory
• http://openafs.org/pages/security/OPENAFS-SA-2018-001.txtVendor Advisory
• https://lists.debian.org/debian-lts-announce/2018/09/msg00024.htmlThird Party Advisory
• https://www.debian.org/security/2018/dsa-4302Third Party Advisory

Published

Sep 12, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-16933Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16934Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16935Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-16936Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2018-1694IBM Jazz applications (IBM Rational Collaborative Lifecycle …5.9
• CVE-2018-16946LG LNB*, LND*, LNU*, and LNV* smart network camera devices h…
• CVE-2018-16948An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-16949An issue was discovered in OpenAFS before 1.6.23 and 1.8.x b…
• CVE-2018-1695IBM WebSphere Application Server 7.0, 8.0, and 8.5.5 install…7.3
• CVE-2018-16950Inteno DG400 WU7U_ELION3.11.6-170614_1328 devices allow remo…
• CVE-2018-16951xunfeng 0.2.0 allows command execution via CSRF because mass…
• CVE-2018-16952The Oracle WebCenter Interaction Portal 10.3.3 does not impl…