CVE-2020-10762

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-732 CWE-532

Affected software

Vendor	Product	Versions
n/a	gluster-block	gluster-block 0.5.1

References

https://bugzilla.redhat.com/show_bug.cgi?id=1845067Issue Tracking, Mitigation, Vendor Advisory
https://github.com/gluster/gluster-block/releases/tag/v0.5.1Release Notes, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1845067Issue Tracking, Mitigation, Vendor Advisory
https://github.com/gluster/gluster-block/releases/tag/v0.5.1Release Notes, Third Party Advisory

Timeline

Published: Nov 24, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-107635.5An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information. This flaw allows an attacker with local CVE-2020-107665.5A logic bug flaw was found in Linux kernel before 5.8-rc1 in the implementation of SSBD. A bug in the logic handling allows an attacker with CVE-2020-107675.5A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB (Indirect Branch Prediction Barrier). The IBP CVE-2020-107685.5A flaw was found in the Linux Kernel before 5.8-rc1 in the prctl() function, where it can be used to enable indirect branch speculation afte CVE-2020-107695.5A buffer over-read flaw was found in RH kernel versions before 5.0 in crypto_authenc_extractkeys in crypto/authenc.c in the IPsec Cryptograp CVE-2020-10777.8An elevation of privilege vulnerability exists when the Windows Runtime improperly handles objects in memory. An attacker who successfully e CVE-2020-107705.3A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter CVE-2020-107717.1A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. CVE-2020-107727.5An incomplete fix for CVE-2020-12662 was shipped for Unbound in Red Hat Enterprise Linux 7, as part of erratum RHSA-2020:2414. Vulnerable ve CVE-2020-107734.4A stack information leak flaw was found in s390/s390x in the Linux kernel’s memory manager functionality, where it incorrectly writes to the CVE-2020-107745.5A memory disclosure flaw was found in the Linux kernel's versions before 4.18.0-193.el8 in the sysctl subsystem when reading the /proc/sys/k CVE-2020-107755.3An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to redirect users to arb