Skip to content
Fencer Vulns
critical 9.8

CVE-2018-14649 in the critical feed json

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode.

published 2018-10-09 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-6547

cvss
9.8
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
12.0%
EPSS 12.0% chance of exploitation in 30 days, percentile 96%
public exploits
0
none known

Summary

It was found that ceph-isci-cli package as shipped by Red Hat Ceph Storage 2 and 3 is using python-werkzeug in debug shell mode. This is done by setting debug=True in file /usr/bin/rbd-target-api provided by ceph-isci-cli package. This allows unauthenticated attackers to access this debug shell and escalate privileges. Once an attacker has successfully connected to this debug shell they will be able to execute arbitrary commands remotely. These commands will run with the same privileges as of user executing the application which is using python-werkzeug with debug shell mode enabled. In - Red Hat Ceph Storage 2 and 3, ceph-isci-cli package runs python-werkzeug library with root level permissions.

Patch / fix

  • ceph-iscsi-cli ceph storage 3 2.7-7.el7cp
  • ceph-iscsi-cli ceph storage 2 2.0-7.el7cp

red hat advisories RHSA-2018:2838RHSA-2018:2837

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-14649 updated cvss 9.8

ceph-iscsi-cli: rbd-target-api service runs in debug mode allowing for remote command execution

  • Red Hat Ceph Storage 2.5 Tools ceph-iscsi-cli 2.0-7.el7cp
    fixed: vendor fix RHSA-2018:2837
  • Red Hat Ceph Storage 3.1 Tools ceph-iscsi-cli 2.7-7.el7cp
    fixed: vendor fix RHSA-2018:2838

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

11.96% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/ceph/ceph-iscsi-cli/issues/120 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.0 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • [UNKNOWN] ceph-iscsi-cli

Classification

Weakness
  • CWE-77 Improper Neutralization of Special Elements used in a Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.