Redhat: >> Gluster Storage >> 3.4 Security Vulnerabilities
The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could exploit this via the 'GF_XATTROP_ENTRY_IN_KEY' xattrop to create arbitrary, empty files on the target server.
CVSS Score
5.4
EPSS Score
0.014
Published
2018-10-31
A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster storage volume and escalate privileges by scheduling malicious cronjob via symlink.
CVSS Score
8.1
EPSS Score
0.052
Published
2018-04-18