CVE-2018-1000028 is an Incorrect Access Control vulnerability in the Linux kernel's NFS server (nfsd), affecting versions 4.15-rc4+, 4.14.8+, 4.9.76+, and 4.4.111+. This flaw allows remote users to bypass intended permissions, enabling unauthorized reading or writing of files on NFS-exported filesystems configured with the "rootsquash" option. Rated with a CVSS score of 7.4 (High), the vulnerability has a network attack vector and high attack complexity, leading to high confidentiality and integrity impacts without affecting availability. While the EPSS score is low, indicating a low probability of exploitation, the FAUCET Risk Score is 47/100. There is currently no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 4.4.111, <= 4.4.119CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.9.76, <= 4.9.85CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.14.8, <= 4.14.23CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 4.15.1, <= 4.15.7CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
4.15CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:4.15:rc4:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.