CVE-2019-10225

A flaw was found in atomic-openshift of openshift-4.2 where the basic-user RABC role in OpenShift Container Platform doesn't sufficiently protect the GlusterFS StorageClass against leaking of the restuserkey. An attacker with basic-user permissions is able to obtain the value of restuserkey, and use it to authenticate to the GlusterFS REST service, gaining access to read, and modify files.

• CWE-522

• https://bugzilla.redhat.com/show_bug.cgi?id=1743073Issue Tracking, Mitigation, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1743073Issue Tracking, Mitigation, Third Party Advisory

Published

Mar 19, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1022An elevation of privilege exists in Windows Audio Service. A…7.8
• CVE-2019-10220Linux kernel CIFS implementation, version 4.9.0 is vulnerabl…8.8
• CVE-2019-10221A Reflected Cross Site Scripting vulnerability was found in …6.1
• CVE-2019-10222A flaw was found in the Ceph RGW configuration with Beast as…7.5
• CVE-2019-10223A security issue was discovered in the kube-state-metrics ve…6.5
• CVE-2019-10224A flaw has been found in 389-ds-base versions 1.4.x.x before…4.6
• CVE-2019-10226HTML Injection has been discovered in the v0.19.0 version of…
• CVE-2019-10227openITCOCKPIT before 3.7.1 has reflected XSS in the 404-not-…6.1
• CVE-2019-10229An issue was discovered in MailStore Server (and Service Pro…8.8
• CVE-2019-1023An information disclosure vulnerability exists when the scri…6.5
• CVE-2019-10231Teclib GLPI before 9.4.1.1 is affected by a PHP type jugglin…
• CVE-2019-10232Teclib GLPI through 9.3.3 has SQL injection via the "cycle" …