The Heketi Project

Records4All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical1CVSS 9.0–10.0

CVSS high2CVSS 7.0–8.9

Exploited now

The Heketi Project records in CISA KEV

No The Heketi Project vulnerabilities are listed in CISA KEV.

Products in the NVD configurations · select one to filter the records

4 records

TI-2017-11077 CVE-2017-15103 · GHSA-6g56-v9qg-jp92

MEDIUM 46

A security-check flaw was found in the way the Heketi 5 server API handled user requests.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.05495 Published 2017-12-18 Fixed in 5.0.1 CWE-78

TI-2019-02907 CVE-2019-3899 · GHSA-g8m6-5j3r-8xg4

MEDIUM 45

It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01414 Published 2019-04-22 Fixed CWE-592

TI-2017-11078 CVE-2017-15104 · GHSA-q9vw-wr57-xjv3

LOW 34

An access flaw was found in Heketi 5, where the heketi.json configuration file was world readable.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00428 Published 2017-12-18 Fixed in 5.0.1 CWE-552

TI-2020-08660 CVE-2020-10763 · GHSA-rm7c-x6gj-2mr8

LOW 25

An information-disclosure flaw was found in the way Heketi before 10.1.0 logs sensitive information.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00419 Published 2020-11-24 Partial fix · 10.1.0 CWE-532