CVE-2021-36780
HIGHLonghorn < 1.1.3 - Unauthenticated Critical Function Access via Replica Instance
Title source: llmDescription
A Missing Authentication for Critical Function vulnerability in longhorn of SUSE Longhorn allows attackers to connect to a longhorn-engine replica instance granting it the ability to read and write data to and from a replica that they should not have access to. This issue affects: SUSE Longhorn longhorn versions prior to 1.1.3; longhorn versions prior to 1.2.3v.
References (2)
Core 2
Core References
Issue Tracking, Vendor Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1191819
Third Party Advisory
https://github.com/longhorn/longhorn/security/advisories/GHSA-g358-m2wp-mhhx
Scores
CVSS v3
8.1
EPSS
0.0006
EPSS Percentile
17.4%
Attack Vector
ADJACENT_NETWORK
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Details
CWE
CWE-306
Status
published
Products (1)
linuxfoundation/longhorn
< 1.1.3
Published
Dec 17, 2021
Tracked Since
Feb 18, 2026