CVE-2020-10763
Last modified
CVE-2020-10763 is a medium-severity vulnerability rated 5.5/10 on the CVSS scale. An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.. EPSS estimates a 0.41% chance of exploitation in the next 30 days.
Description
An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local access to the Heketi server to read potentially sensitive information such as gluster-block passwords.
Metrics
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Heketi Project | Heketi | < 10.1.0 |
| Redhat | Gluster Storage | 3.0 |
| Redhat | Gluster Storage | 3.5 |
| Redhat | Openshift Container Platform | 4.0 |
| Redhat | Enterprise Linux | 7.0 |
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1845387Issue Tracking, Third Party Advisory
- https://github.com/heketi/heketi/releases/tag/v10.1.0Release Notes, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1845387Issue Tracking, Third Party Advisory
- https://github.com/heketi/heketi/releases/tag/v10.1.0Release Notes, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-10763?
How severe is CVE-2020-10763?
How do I fix CVE-2020-10763?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-10758A vulnerability was found in Keycloak before 11.0.1 where Do…7.5
- CVE-2020-10759A PGP signature bypass flaw was found in fwupd (all versions…6
- CVE-2020-1076A denial of service vulnerability exists when Windows improp…5.5
- CVE-2020-10760A use-after-free flaw was found in all samba LDAP server ver…6.5
- CVE-2020-10761An assertion failure issue was found in the Network Block De…5
- CVE-2020-10762An information-disclosure flaw was found in the way that glu…5.5
- CVE-2020-10764Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-10765Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
- CVE-2020-10766A logic bug flaw was found in Linux kernel before 5.8-rc1 in…5.5
- CVE-2020-10767A flaw was found in the Linux kernel before 5.8-rc1 in the i…5.5
- CVE-2020-10768A flaw was found in the Linux Kernel before 5.8-rc1 in the p…5.5
- CVE-2020-10769A buffer over-read flaw was found in RH kernel versions befo…5.5
Are you affected by CVE-2020-10763?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST