CVE-2018-1079

🗓️ 12 Apr 2018 17:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov👁 69 Views🌐 WEB

pcs version 0.9.164 and 0.10 privilege escalation vulnerabilit

Reporter	Title	Published	Views	Family All 35
Tenable Nessus	Amazon Linux 2 : pcs (ALAS-2018-1005)	27 Apr 201800:00	–	nessus
Tenable Nessus	CentOS 7 : pcs (CESA-2018:1060)	31 May 201800:00	–	nessus
Tenable Nessus	Fedora 27 : pcs (2018-57bbe74c6c)	19 Apr 201800:00	–	nessus
Tenable Nessus	Fedora 28 : pcs (2018-bbfb0f5bc9)	3 Jan 201900:00	–	nessus
Tenable Nessus	Fedora 26 : pcs (2018-ce5d7106d8)	19 Apr 201800:00	–	nessus
Tenable Nessus	MiracleLinux 7 : pcs-0.9.162-5.el7.1 (AXSA:2018-2813:01)	16 Jan 202600:00	–	nessus
Tenable Nessus	NewStart CGSL CORE 5.04 / MAIN 5.04 : pcs Multiple Vulnerabilities (NS-SA-2019-0042)	12 Aug 201900:00	–	nessus
Tenable Nessus	Oracle Linux 7 : pcs (ELSA-2018-1060)	1 May 201800:00	–	nessus
Tenable Nessus	RHEL 7 : pcs (RHSA-2018:1060)	11 Apr 201800:00	–	nessus
Tenable Nessus	Scientific Linux Security Update : pcs on SL7.x x86_64 (20180410)	1 May 201800:00	–	nessus

NVD

Vulners

Node

clusterlabs pacemaker_command_line_interfaceRange≤0.9.164

clusterlabs pacemaker_command_line_interfaceMatch0.10

Node

redhat enterprise_linuxMatch7.0

redhat enterprise_linuxMatch7.5

[
  {
    "product": "pcs",
    "vendor": "unspecified",
    "versions": [
      {
        "status": "affected",
        "version": "pcs 0.9.164"
      },
      {
        "status": "affected",
        "version": "pcs 0.10"
      }
    ]
  }
]

Source	Link
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/errata/RHSA-2018:1060

Parameter	Position	Path	Description	CWE
filename	query param	/remote/put_file	Privilege escalation via unsanitized file name in the /remote/put_file query enabling creation/overwrite of arbitrary files outside /etc/booth for authenticated users with write permissions	CWE-552, CWE-22

21 Nov 2024 03:59Current

6.8Medium risk

Vulners AI Score6.8

CVSS 24

CVSS 36.5 - 8.7

EPSS0.00408