CVE-2021-36780: Unauthorized data access from replicas through vulnerable instance manager pods
First published: Fri Dec 17 2021(Updated: )
A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.
Credit: meissner@suse.de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linuxfoundation Longhorn | <1.1.3 | |
| Linuxfoundation Longhorn | >=1.2.0<1.2.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-index
- agent/references
- agent/softwarecombine
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- vendor/linuxfoundation
- canonical/linuxfoundation longhorn
- version/linuxfoundation longhorn/1.2.0