Ubuntu
CVE-2018-4220
HIGH
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
An issue was discovered in certain Apple products. Swift before 4.1.1 Security Update 2018-001 is affected. The issue involves the "Swift for Ubuntu" component. It allows attackers to execute arbitrary code in a privileged context because write and execute permissions are enabled during library loading.
AnalysisAI
An issue was discovered in certain Apple products. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Incorrect Permission Assignment (CWE-732), which allows attackers to access resources due to misconfigured permissions. An issue was discovered in certain Apple products. Swift before 4.1.1 Security Update 2018-001 is affected. The issue involves the "Swift for Ubuntu" component. It allows attackers to execute arbitrary code in a privileged context because write and execute permissions are enabled during library loading. Affected products include: Apple Swift. Version information: before 4.1.1.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and restrict file/resource permissions, apply principle of least privilege.
OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing
An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1
Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubn
Remote unauthenticated denial of service in OpenStack Swift through 2.38.0 allows any network-reachable attacker to exha
OpenStack Object Storage (Swift) before 2.3.1 (Kilo), 2.4.x, and 2.5.x before 2.5.1 (Liberty) do not properly close serv
OpenStack Object Storage (Swift) before 2.4.0 does not properly close client connections, which allows remote attackers
Isode SWIFT v4.0.2 was discovered to contain hard-coded credentials in the Registry Editor. Rated high severity (CVSS 7.
A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious
A stack overflow issue existed in Swift for Linux. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
Denial of service in OpenStack Swift's s3api middleware allows an authenticated S3 API user to permanently hang proxy-se
Cross-tenant object exfiltration in OpenStack Swift through 2.38.0 allows authenticated S3 API users to bypass source-ob
OpenStack Swift's S3API middleware through version 2.38.0 fails to enforce SigV4 signature coverage over semantic x-amz-
Share
External POC / Exploit Code
Leaving vuln.today