Path Traversal in OpenStack Tripleo-Common
CVE-2017-2627
A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. The sudoers file as installed with OSP's openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal with '..' and it grants full passwordless root access to the validations user.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.2 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.007 (49.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 50th percentile — 49.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.007 · newest: 0.007 · change: 0.000
Affected products
- OpenStack Tripleo-Common
- Red Hat Openstack-Tripleo-Common — versions As shipped with Red Hat Openstack Enterprise 10 and 11
- Red Hat OpenStack — versions 10, 11
Weakness classification (CWE)
References
- bugzilla.redhat.com/show_bug.cgi (Issue Tracking, Vendor Advisory)
Frequently asked questions
- What is CVE-2017-2627?
- CVE-2017-2627 is a high-severity vulnerability in OpenStack Tripleo-Common, classified under Path Traversal. CVSS score: 8.2/10. Published 2018-08-22.
- How severe is CVE-2017-2627?
- High severity. CVSS v3 base score is 8.2 out of 10.