CVE-2018-14649
CVSS v3
9.8
CRITICAL
EPSS Score
58.1 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.
Technical details
- Published
- 2018-10-09
Frequently asked questions
What is CVE-2018-14649?
It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.
Is CVE-2018-14649 actively exploited?
Active exploitation of CVE-2018-14649 has not been confirmed. The EPSS score is 58.1%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2018-14649?
CVE-2018-14649 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2018-14649 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2018 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).