Lucene search

RedhatCVE-2020-25654

HistoryNov 24, 2020 - 8:15 p.m.

CVE-2020-25654

2020-11-2420:15:11

CWE-284

redhat

web.nvd.nist.gov

162

acl bypass

pacemaker

unauthorized access

cve-2020-25654

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

6.6

Confidence

High

EPSS

0.002

Percentile

57.2%

JSON

An ACL bypass flaw was found in pacemaker. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went through the configuration.

Affected configurations

Nvd

Vulners

Node

clusterlabspacemakerRange<1.1.23

clusterlabspacemakerRange2.0.0–2.0.3

clusterlabspacemakerMatch2.0.5rc1

Node

debiandebian_linuxMatch9.0

VendorProductVersionCPE
clusterlabspacemaker*cpe:2.3:a:clusterlabs:pacemaker:*:*:*:*:*:*:*:*
clusterlabspacemaker2.0.5cpe:2.3:a:clusterlabs:pacemaker:2.0.5:rc1:*:*:*:*:*:*
debiandebian_linux9.0cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
clusterlabs	pacemaker	*	cpe:2.3:a:clusterlabs:pacemaker::::::::
clusterlabs	pacemaker	2.0.5	cpe:2.3:a:clusterlabs:pacemaker:2.0.5:rc1::::::
debian	debian_linux	9.0	cpe:2.3:o:debian:debian_linux:9.0:::::::*

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "pacemaker",
    "versions": [
      {
        "version": "pacemaker 1.1.24-rc1, pacemaker 2.0.5-rc2",
        "status": "affected"
      }
    ]
  }
]