CVE-2015-5190

2015-09-0314:59:04

CWE-77

redhat

web.nvd.nist.gov

security

vulnerability

pcsd

web ui

command execution

url

nvd

CVSS2

8.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:S/C:C/I:C/A:C

AI Score

7.1

Confidence

Low

EPSS

0.003

Percentile

71.6%

JSON

The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via “escape characters” in a URL.

Affected configurations

Nvd

Node

pacemaker\/corosync_configuration_system_projectpacemaker\/corosync_configuration_systemRange≤0.9.139

VendorProductVersionCPE
pacemaker\/corosync_configuration_system_projectpacemaker\/corosync_configuration_system*cpe:2.3:a:pacemaker\/corosync_configuration_system_project:pacemaker\/corosync_configuration_system:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
pacemaker\/corosync_configuration_system_project	pacemaker\/corosync_configuration_system	*	cpe:2.3:a:pacemaker\/corosync_configuration_system_project:pacemaker\/corosync_configuration_system::::::::