CVE-2018-1112

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

No affected versions have been published.

Timeline

Published: Apr 25, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-111206.1Services/COPage/classes/class.ilPCSourceCode.php in ILIAS 5.1.x, 5.2.x, and 5.3.x before 5.3.5 has XSS.CVE-2018-111245.4Cross-site scripting (XSS) vulnerability in Attributes functionality in Open-AudIT Community edition before 2.2.2 allows remote attackers to CVE-2018-111268.8dg-user/?controller=users&action=add in doorGets 7.0 has CSRF that results in adding an administrator account.CVE-2018-111276.5e107 2.1.7 has CSRF resulting in arbitrary user deletion.CVE-2018-111287.8The ObjReader::ReadObj() function in ObjReader.cpp in vincent0629 PDFParser allows remote attackers to cause a denial of service (stack-base CVE-2018-111297.8The header::add_INFO_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-fr CVE-2018-11135.3setup before version 2.11.4-1.fc28 in Fedora and Red Hat Enterprise Linux added /sbin/nologin and /usr/sbin/nologin to /etc/shells. This vio CVE-2018-111307.8The header::add_FORMAT_descriptor function in header.cpp in VCFtools 0.1.15 allows remote attackers to cause a denial of service (use-after-CVE-2018-111328.8In order to perform actions that require higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue tha CVE-2018-111336.1The 'fmt' parameter of the '/common/run_cross_report.php' script in the the Quest KACE System Management Appliance 8.0.318 is vulnerable to CVE-2018-111348.8In order to perform actions that requires higher privileges, the Quest KACE System Management Appliance 8.0.318 relies on a message queue ma CVE-2018-111358.8The script '/adminui/error_details.php' in the Quest KACE System Management Appliance 8.0.318 allows authenticated users to conduct PHP obje