CVE-2017-15103

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

A security-check flaw was found in the way the Heketi 5 server API handled user requests. An authenticated Heketi user could send specially crafted requests to the Heketi server, resulting in remote command execution as the user running Heketi server and possibly privilege escalation.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78 CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Dec 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-151047.8An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the He CVE-2017-151055.3A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record c CVE-2017-151077.5A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be im CVE-2017-151087.8spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with acces CVE-2017-151104.3In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students c CVE-2017-151115.5keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via sy CVE-2017-151127.8keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command histo CVE-2017-151136.6ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can CVE-2017-151148.1When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority CVE-2017-151157.8The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a pee CVE-2017-151165.5The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer derefer CVE-2017-151189.8A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an expor