Paper/Archive/CVE-2023-51786

CVE-2023-51786

lustre lustre — An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain s…

EPSS 0.5%CVSS 9.1

critical.is priorityof 100

CVSS 9.1 (ADP)9.1 / 10 × 3027.3 Not in CISA KEV+300.0 EPSS percentile 42.8.428 × 208.6 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sensitive information via Incorrect Access Control.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

lustre2.12.0 – < 2.15.42.15.4CISA-ADP

Scores by source

CISA ADP9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

reflists.lustre.org/pipermail/lustre-announce-lustre.org/2024/000270.html refopenwall.com/lists/oss-security/2024/03/12/2