Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems.

Published 8 y ago 2018-03-09 · modified 4 mo ago 2026-06-17 · JSON

CVSS

7.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

0.6%

percentile 48%

Public exploits

none known

Red Hat OpenShift Enterprise version 3.7 is vulnerable to access control override for container network filesystems. An attacker could override the UserId and GroupId for GlusterFS and NFS to read and write any data on the network filesystem.

Exploit prediction (EPSS)

0.58% probability of exploitation in the next 30 days, higher than 48% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	7.1	`CVSS:3.0/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	5.4	`AV:A/AC:M/Au:N/C:P/I:P/A:P`

Affected products

Red Hat, Inc. OpenShift Enterprise

Classification

Weakness

CWE-284 Improper Access Control
CWE-732 Incorrect Permission Assignment for Critical Resource

References

bugzilla.redhat.com /show_bug.cgi?id=1552987 · x_refsource_CONFIRM, x_transferred
securityfocus.com /bid/103364 · vdb-entry, x_refsource_BID, x_transferred

Sources

CVE List: CVE-2018-1069
NVD: CVE-2018-1069

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.