Vulnerability CVE-2015-5189

Vulnerability CVE-2015-5189

Published: 2015-09-03

Description:

Race condition in pcsd in PCS 0.9.139 and earlier uses a global variable to validate usernames, which allows remote authenticated users to gain privileges by sending a command that is checked for security after another user is authenticated.

CVSS2 => (AV:N/AC:M/Au:S/C:P/I:P/A:N)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.9/10	4.9/10	6.8/10

Exploit range	Attack complexity	Authentication
Remote	Medium	Single time
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	None

Affected software
Pacemaker/corosync configuration system project -> Pacemaker/corosync configuration system

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1252805

http://rhn.redhat.com/errata/RHSA-2015-1700.html

Copyright 2024, cxsecurity.com