« Volver al listado

CVE-2020-10762

Estado: ModificadaMedia (5.5)—

Se encontró un fallo de la divulgación de información en la forma en que gluster-block versiones anteriores a 0.5.1, registra la salida de las operaciones CLI de gluster-block. Esto incluye la grabación de contraseñas en el archivo cmd_history.log, que es de tipo world-readable. Este fallo permite a usuarios locales obtener información confidencial al leer el archivo de registro. La mayor amenaza de esta vulnerabilidad es la confidencialidad de los datos

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Redhat — Gluster-block

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-10762",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "gluster-block",
          "versions": [
            {
              "status": "affected",
              "version": "gluster-block 0.5.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-11-24T17:15:10.567",
  "references": [
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845067",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://github.com/gluster/gluster-block/releases/tag/v0.5.1",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845067",
      "tags": [
        "Issue Tracking",
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/gluster/gluster-block/releases/tag/v0.5.1",
      "tags": [
        "Release Notes",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality."
    },
    {
      "lang": "es",
      "value": "Se encontró un fallo de la divulgación de información en la forma en que gluster-block versiones anteriores a 0.5.1, registra la salida de las operaciones CLI de gluster-block. Esto incluye la grabación de contraseñas en el archivo cmd_history.log, que es de tipo world-readable. Este fallo permite a usuarios locales obtener información confidencial al leer el archivo de registro. La mayor amenaza de esta vulnerabilidad es la confidencialidad de los datos"
    }
  ],
  "lastModified": "2026-06-17T02:48:23.960",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:redhat:gluster-block:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "61C9429E-AA5B-4AFD-8E92-61A33438F6EB",
              "versionEndExcluding": "0.5.1"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}