{"id":"CVE-2018-1127","aliases":["EUVD-2018-11771","GHSA-jwq3-h8rx-wcwj","RHSA-2018:2616"],"status":"published","title":"Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens...","description":"Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.","severity":{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01265,"percentile":0.69922,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-384","CWE-613"],"published":"2018-09-11T15:00:00Z","modified":"2026-07-01T10:04:26Z","fixes":[{"ecosystem":"Red Hat:storage:3.4:na:el7","package":"tendrl-commons","fixed_in":["0:1.6.3-12.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:na:el7","package":"tendrl-gluster-integration","fixed_in":["0:1.6.3-10.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:na:el7","package":"tendrl-node-agent","fixed_in":["0:1.6.3-10.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"python-flask","fixed_in":["1:0.10.1-5.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"python-flask-doc","fixed_in":["1:0.10.1-5.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"python-itsdangerous","fixed_in":["0:0.23-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-ansible","fixed_in":["0:1.6.3-7.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-api","fixed_in":["0:1.6.3-5.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-api-httpd","fixed_in":["0:1.6.3-5.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-commons","fixed_in":["0:1.6.3-12.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-grafana-plugins","fixed_in":["0:1.6.3-11.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-monitoring-integration","fixed_in":["0:1.6.3-11.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-node-agent","fixed_in":["0:1.6.3-10.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-notifier","fixed_in":["0:1.6.3-4.el7rhgs"],"sources":["osv"]},{"ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-ui","fixed_in":["0:1.6.3-11.el7rhgs"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:storage:3.4:na:el7","package":"tendrl-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-12.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:na:el7","package":"tendrl-gluster-integration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-10.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:na:el7","package":"tendrl-node-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-10.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"python-flask","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.1-5.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"python-flask-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.10.1-5.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"python-itsdangerous","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.23-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-ansible","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-7.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-5.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-api-httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-5.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-12.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-grafana-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-11.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-monitoring-integration","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-11.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-node-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-10.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-notifier","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-4.el7rhgs"}]}]},{"source":"osv","ecosystem":"Red Hat:storage:3.4:wa:el7","package":"tendrl-ui","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.3-11.el7rhgs"}]}]}],"products":[{"vendor":"red hat","product":"red hat gluster storage"},{"vendor":"redhat","product":"gluster_storage"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2018:2616","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Vendor Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1041597","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://github.com/Tendrl/api/pull/422","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1127","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1127","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jwq3-h8rx-wcwj"},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/site/documentation/en-US/red_hat_gluster_storage/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1502012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1506123","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1511993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1512091","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1512696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1512937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1513361","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1513993","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1514171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1514442","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1515660","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1516135","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1516417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1517077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1517132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1517215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1517246","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1517270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1517422","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518276","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518516","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518525","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518610","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1518736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519188","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519201","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1519750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1520886","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1525376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1526338","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1526375","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1531133","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1531139","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1536354","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1538248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1542914","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1546957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1549146","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1555455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1558431","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559362","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559364","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559365","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559368","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559373","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559390","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559396","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559399","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559401","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559415","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559417","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559432","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559433","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559436","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559507","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559792","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1560879","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1561374","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1561428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1561468","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563648","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564423","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1564510","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565479","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1565898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1570048","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1570564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1570616","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1571235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1571244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1571245","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1571280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1571318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1571325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1571755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1571809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1572052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1572090","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1572118","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1572151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1572216","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1573079","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1573110","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1573481","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1573928","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1573950","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1574938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1574942","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575040","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1576794","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1576829","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1576848","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578009","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578333","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1578885","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579148","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579150","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579516","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1579937","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1580385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1580509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581718","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1581789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1582465","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1583171","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1584095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1584660","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1585116","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1585715","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1586074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1588357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1588440","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1588650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1590405","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1592464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1592487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1592991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1592992","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1593640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1593852","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1593912","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1594762","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1594862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1594899","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1594994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595005","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595015","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595052","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1595295","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1596655","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1596820","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1596862","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1597235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1599634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1599985","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1599987","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1600092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1600113","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1603175","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1610266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1611601","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1616208","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1616215","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2616.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1127","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1127","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1127","description":"Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.","status":"published","published":"2018-09-11T15:00:00Z","modified":"2024-08-05T03:51:48.782Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-613"],"updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-11771","description":"Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.","status":"published","published":"2018-09-11T15:00:00Z","modified":"2024-08-05T03:51:48Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:16.874515Z"}],"ghsa":[{"id":"GHSA-jwq3-h8rx-wcwj","title":"Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens...","description":"Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.","status":"published","published":"2022-05-13T01:33:30Z","modified":"2023-02-01T05:08:35Z","cvss":[{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-384"],"updated_at":"2026-11-02T14:50:48.372333Z"}],"nvd":[{"id":"CVE-2018-1127","description":"Tendrl API in Red Hat Gluster Storage before 3.4.0 does not immediately remove session tokens after a user logs out. Session tokens remain active for a few minutes allowing attackers to replay tokens acquired via sniffing/MITM attacks and authenticate as the target user.","status":"published","published":"2018-09-11T15:29:00.593Z","modified":"2026-06-17T01:50:32.62Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.0","score":8.1,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-613","CWE-384"],"updated_at":"2026-11-02T14:04:38.672108Z"}],"osv":[{"id":"RHSA-2018:2616","title":"Red Hat Security Advisory: RHGS WA security, bug fix, and enhancement update","status":"published","published":"2024-09-13T16:52:55Z","modified":"2026-07-01T10:04:26Z","cvss":[{"version":"3.0","score":4.2,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:05.383061Z"}]}}