Veracode Vulnerability DatabaseVERACODE:27898Authorization Bypass
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
9 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C
pacemaker is vulnerable to authorization bypass. The vulnerability exists through an ACL bypass flaw, where users can use IPC communication with the various daemons directly to bypass ACL restrictions.
References
bugzilla.redhat.com/show_bug.cgi?id=1888191
lists.clusterlabs.org/pipermail/users/2020-October/027840.html
lists.debian.org/debian-lts-announce/2021/01/msg00007.html
lists.fedoraproject.org/archives/list/[email protected]/message/HMSWPVSLEUN4QCZPHKBMBZVUXLKKNSMM/
lists.fedoraproject.org/archives/list/[email protected]/message/NG7YJDH5DNOTKZJOHFWSACULGPJUOJMZ/
seclists.org/oss-sec/2020/q4/83
www.openwall.com/lists/oss-security/2020/10/27/1
Related
7.2 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
9 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
SINGLE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:S/C:C/I:C/A:C