CVE-2018-10861: ceph Improper Authorization
Vulnerability summary
CVE-2018-10861 is a high (CVSS 8.1) Improper Authorization vulnerability in ceph. EPSS estimates a 3.18% chance of exploitation in the next 30 days, higher than 88% of scored vulnerabilities.
Not severe (CVSS 8.1, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 9 · Related 6Timeline
- 10-07-2018PublishedVulnerability first disclosed.
- 16-09-2024Last modifiedVulnerability information updated.
Description
A flaw was found in the way ceph mon handles user requests. Any authenticated ceph user having read access to ceph can delete, create ceph storage pools and corrupt snapshot images. Ceph branches master, mimic, luminous and jewel are believed to be affected.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
3.18%
Chance of exploitation in the next 30 days
Percentile
88%
Versus all other CVEs
30-day change
No change 0.00 pp
From 3.18% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-285Improper AuthorizationThe product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat6 products
- ceph_storage3
- ceph_storage_mon2 | 3
- ceph_storage_osd2 | 3
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
Debian2 products
- ceph< 12.2.8+dfsg1-1
- debian_linuxEOL9.0
Ceph1 product
- cephEOL10.2.0 | 10.2.1 | 10.2.2 | 10.2.3 | 10.2.4 | 10.2.5 | 10.2.6 | 10.2.7 | 10.2.8 | 10.2.9 | 10.2.10 | 10.2.11 | 12.2.0 | 12.2.1 | 12.2.2 | 12.2.3 | 12.2.4 | 12.2.5 | 12.2.6 | 12.2.7 | 13.2.0 | 13.2.1
Opensuse1 product
- leapEOL15.0
Red hat, inc.1 product
- cephall versions in branches master, mimic, luminous and jewel
Ubuntu1 product
- cephAll versions (No fix recorded)
6 vendors · 12 products
References
13 links- bugzilla.redhat.com/show_bug.cgi?id=1593308X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- github.com/ceph/ceph/commit/975528f632f73fbffa3f1fee304e3bbe3296cffcX Refsource CONFIRMPatchThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2019-04/msg00100.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory