CVE-2020-10762: redhat gluster-block
Vulnerability summary
CVE-2020-10762 is a medium (CVSS 5.5) vulnerability in redhat gluster-block. EPSS estimates a 0.34% chance of exploitation in the next 30 days, higher than 26.1% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 1Timeline
- 24-11-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
0.34%
Chance of exploitation in the next 30 days
Percentile
26%
Versus all other CVEs
30-day change
0.00 pp
From 0.34% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-732Incorrect Permission Assignment for Critical ResourceThe product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
- CWE-532Insertion of Sensitive Information into Log FileThe product writes sensitive information to a log file.
Affected systems
Redhat1 product
- gluster-block< 0.5.1
1 vendor · 1 product
References
2 links- github.com/gluster/gluster-block/releases/tag/v0.5.1X Refsource MISCRelease NotesThird Party Advisory