CVE-2020-10762 Information disclosure in gluster-block
Local attackers can read sensitive passwords from world-readable log files in gluster-block, compromising data confidentiality.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-10762?
CVE-2020-10762 is a medium-severity vulnerability in gluster-block, published on 24 Nov 2020. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
Which versions are affected by CVE-2020-10762?
It affects 1 product.
Products include Redhat Gluster-Block.
How do I fix CVE-2020-10762?
Upgrade to a fixed version.
Is CVE-2020-10762 being exploited?
There is no known exploitation of CVE-2020-10762 in the wild and no public exploit code.
Sources
Also known as GHSA-3grh-xhcf-mgx4.