CVE-2018-10861 - CVE House
Back to Database
Status published High CVE-2018-10861

A flaw was found in the way ceph mon handles...

Vulnerability Description

A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10861

Credits & Attribution

No credits recorded in the NVD database.

References

More from Red Hat, Inc.

View All →
CVE-2019-3813
Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds...
High 7.5
CVE-2018-1131
Infinispan permits improper deserialization of trusted data via XML and...
High 8.8
CVE-2018-1129
A flaw was found in the way signature calculation was...
Medium 6.5
CVE-2018-1128
It was found that cephx authentication protocol did not verify...
High 7.5
CVE-2018-1106
An authentication bypass flaw has been found in PackageKit before...
Medium 5.5

Affected Vendor

Red Hat, Inc.

View all reports →

Affected Software

ceph
Vulnerable Versions:
all versions in branches master, mimic, luminous and jewel

Timeline

Official Publish: July 10th, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Weaknesses (CWE)

CWE-285

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion