Authentication Bypass

2020-04-1001:02:24

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

cumin is vulnerable to authentication bypass. A flaw was discovered in Cumin where it would log broker authentication credentials to the Cumin log file. A local user exploiting this flaw could connect to the broker outside of Cumin’s control and perform certain operations such as scheduling jobs, setting attributes on jobs, as well as holding, releasing or removing jobs. The user could also use this to, depending on the defined ACLs of the broker, manipulate message queues and other privileged operations.

CPENameOperatorVersion
ruby-rhubarbeq0.3.0__2.el5
ruby-rhubarbeq0.2.7__1.el5
ruby-rhubarbeq0.3.0__2.el6
condoreq7.0.4__4.el5
condoreq7.0.5__2.el5
condoreq7.4.4__0.17.el5
condoreq7.4.1__0.7.el5
condoreq7.4.4__0.16.el5
condoreq7.4.1__0.7.1.el5
condoreq7.2.2__0.9.el5

Name	Operator	Version
ruby-rhubarb	eq	0.3.0__2.el5
ruby-rhubarb	eq	0.2.7__1.el5
ruby-rhubarb	eq	0.3.0__2.el6
condor	eq	7.0.4__4.el5
condor	eq	7.0.5__2.el5
condor	eq	7.4.4__0.17.el5
condor	eq	7.4.1__0.7.el5
condor	eq	7.4.4__0.16.el5
condor	eq	7.4.1__0.7.1.el5
condor	eq	7.2.2__0.9.el5