Information Exposure in Heketi

Also known as GHSA-q9vw-wr57-xjv3, GO-2022-0866

Published 8 y ago 2017-12-18 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.8

v3.1 · NVD

CISA KEV

not known exploited

EPSS

0.4%

percentile 37%

Public exploits

none known

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.

Exploit prediction (EPSS)

0.43% probability of exploitation in the next 30 days, higher than 37% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	2.1	`AV:L/AC:L/Au:N/C:P/I:N/A:N`
GitHub	3.1	7.8	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

Affected packages

Ecosystem	Package	Affected	Fixed in
go	`github.com/heketi/heketi`	<5.0.1 <5.0.1+incompatible	5.0.1 5.0.1+incompatible

Affected products

Heketi Heketi

Classification

Weakness

CWE-552 Files or Directories Accessible to External Parties
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

access.redhat.com /errata/RHSA-2017:3481 · vendor-advisory, x_refsource_REDHAT, x_transferred
bugzilla.redhat.com /show_bug.cgi?id=1510149 · x_refsource_CONFIRM, x_transferred
access.redhat.com /security/cve/CVE-2017-15104 · x_refsource_CONFIRM, x_transferred
github.com /heketi/heketi/releases/tag/v5.0.1 · x_refsource_CONFIRM, x_transferred
nvd.nist.gov /vuln/detail/CVE-2017-15104 · advisory
github.com /heketi/heketi/commit/787bae461b23003a4daa4d1d639016a754cf6b00 · web
github.com /advisories/GHSA-q9vw-wr57-xjv3 · advisory

Sources

CVE List: CVE-2017-15104
GitHub Advisory: GHSA-q9vw-wr57-xjv3
NVD: CVE-2017-15104
OSV: GO-2022-0866

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary