CVE-2017-15104

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable. An attacker having local access to the Heketi server could read plain-text passwords from the heketi.json file.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-552CWE-200

Affected software

No affected versions have been published.

Timeline

Published
Dec 18, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-151055.3A flaw was found in the way unbound before 1.6.8 validated wildcard-synthesized NSEC records. An improperly validated wildcard NSEC record cCVE-2017-151077.5A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be imCVE-2017-151087.8spice-vdagent up to and including 0.17.0 does not properly escape save directory before passing to shell, allowing local attacker with accesCVE-2017-151104.3In Moodle 3.x, students can find out email addresses of other students in the same course. Using search on the Participants page, students cCVE-2017-151115.5keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via syCVE-2017-151127.8keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command histoCVE-2017-151136.6ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can CVE-2017-151148.1When libvirtd is configured by OSP director (tripleo-heat-templates) to use the TLS transport it defaults to the same certificate authority CVE-2017-151157.8The sctp_do_peeloff function in net/sctp/socket.c in the Linux kernel before 4.14 does not check whether the intended netns is used in a peeCVE-2017-151165.5The rngapi_reset function in crypto/rng.c in the Linux kernel before 4.2 allows attackers to cause a denial of service (NULL pointer dereferCVE-2017-151189.8A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an exporCVE-2017-151198.6The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a c