CVE-2020-10762
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the...
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
- Record
CVE-2020-10762- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-732, CWE-532
- Updated
- 2026-11-02
CVE List No score
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
- Record
CVE-2020-10762- Weakness
- CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2020-3178 No score
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
- Record
EUVD-2020-3178- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-3grh-xhcf-mgx4 No score
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the...
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
- Record
GHSA-3grh-xhcf-mgx4- Weakness
- CWE-532
- Updated
- 2026-11-02
OSV
An information-disclosure flaw was found in the way that gluster-block before 0.5.1 logs the output from gluster-block CLI operations. This includes recording passwords to the cmd_history.log file which is world-readable. This flaw allows local users to obtain sensitive information by reading the log file. The highest threat from this vulnerability is to data confidentiality.
- Record
CVE-2020-10762- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2020:4143
Red Hat Security Advisory: OCS 3.11.z async security, bug fix, and enhancement update
- Record
RHSA-2020:4143- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gluster-blockRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:0.2.1-36.2.el7rhgs | 0:0.2.1-36.2.el7rhgs |
gluster-block-debuginfoRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:0.2.1-36.2.el7rhgs | 0:0.2.1-36.2.el7rhgs |
heketiRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:9.0.0-9.5.el7rhgs | 0:9.0.0-9.5.el7rhgs |
heketi-clientRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:9.0.0-9.5.el7rhgs | 0:9.0.0-9.5.el7rhgs |
libtcmuRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:1.2.0-32.2.el7rhgs | 0:1.2.0-32.2.el7rhgs |
libtcmu-develRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:1.2.0-32.2.el7rhgs | 0:1.2.0-32.2.el7rhgs |
python-heketiRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:9.0.0-9.5.el7rhgs | 0:9.0.0-9.5.el7rhgs |
tcmu-runnerRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:1.2.0-32.2.el7rhgs | 0:1.2.0-32.2.el7rhgs |
tcmu-runner-debuginfoRed Hat:storage:3.5:server:el7 From an advisory covering 2 CVEs |
before 0:1.2.0-32.2.el7rhgs | 0:1.2.0-32.2.el7rhgs |
heketiRed Hat:storage:3:client:el7 From an advisory covering 2 CVEs |
before 0:9.0.0-9.5.el7rhgs | 0:9.0.0-9.5.el7rhgs |
heketi-clientRed Hat:storage:3:client:el7 From an advisory covering 2 CVEs |
before 0:9.0.0-9.5.el7rhgs | 0:9.0.0-9.5.el7rhgs |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-10762 is a medium vulnerability (CVSS 5.5) in Redhat Gluster-block, published November 24, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.
References
bugzilla.redhat.com/show_bug.cgi?id=1845067
github.com/gluster/gluster-block/releases/tag/v0.5.1
nvd.nist.gov/vuln/detail/CVE-2020-10762
access.redhat.com/errata/RHSA-2020:4143
Show 12 moreShow less
security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4143.json
cve.org/CVERecord?id=CVE-2020-10762