CVE-2015-5190

2015-09-0314:59:04

CWE-77

[email protected]

web.nvd.nist.gov

security

vulnerability

pcsd

web ui

command execution

url

nvd

8.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

7.1 High

AI Score

Confidence

Low

0.003 Low

EPSS

Percentile

71.7%

JSON

The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via “escape characters” in a URL.

Affected configurations

NVD

Node

pacemaker\/corosync_configuration_system_projectpacemaker\/corosync_configuration_systemRange≤0.9.139

CPENameOperatorVersion
pacemaker\/corosync_configuration_system_project:pacemaker\/corosync_configuration_systempacemaker/corosync configuration system project pacemaker/corosync configuration systemle0.9.139

CPE	Name	Operator	Version
pacemaker\/corosync_configuration_system_project:pacemaker\/corosync_configuration_system	pacemaker/corosync configuration system project pacemaker/corosync configuration system	le	0.9.139