CVE-2018-1086

2018-04-1216:00:00

CWE-20

redhat

www.cve.org

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

7.5 High

AI Score

Confidence

High

0.006 Low

EPSS

Percentile

78.2%

JSON

pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass. REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

CNA Affected

[
  {
    "product": "pcs",
    "vendor": "redhat",
    "versions": [
      {
        "status": "affected",
        "version": "pcs 0.9.164"
      },
      {
        "status": "affected",
        "version": " pcs 0.10"
      }
    ]
  }
]