CVE-2018-1127

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-09-11 · updated 2026-06-17
Weakness: CWE-613

Description

Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.

Affected products

Red Hat, Inc. Gluster Storage for RHEL 6: before 3.4 — fixed in 3.4

How to fix

Upgrade to a fixed version: Red Hat, Inc. Gluster Storage for RHEL 6 3.4. Check the vendor advisory for mitigations.

References

http://www.securitytracker.com/id/1041597
https://access.redhat.com/errata/RHSA-2018:2616
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1127
https://github.com/Tendrl/api/pull/422
http://www.securitytracker.com/id/1041597
https://access.redhat.com/errata/RHSA-2018:2616
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1127
https://github.com/Tendrl/api/pull/422

Get alerted when CVE-2018-1127 or the next vulnerability affects your stack