CVE-2018-1086

Impact:
Moderate
Public Date:
2018-04-09
CWE:
CWE-20
Bugzilla:
1557366: CVE-2018-1086 pcs: Debug parameter removal bypass, allowing information disclosure
It was found that the REST interface of the pcsd service did not properly remove the pcs debug argument from the /run_pcs query, possibly disclosing sensitive information. A remote attacker with a valid token could use this flaw to elevate their privilege.

Find out more about CVE-2018-1086 from the MITRE CVE dictionary dictionary and NIST NVD.

CVSS v3 metrics

CVSS3 Base Score 4.3
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Impact None
Availability Impact None

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 6 (pcs) RHSA-2018:1927 2018-06-19
Red Hat Enterprise Linux 7 (pcs) RHSA-2018:1060 2018-04-10

Affected Packages State

Platform Package State
Red Hat Gluster Storage 3 pcs Will not fix
Red Hat Enterprise Linux 8 pcs Not affected

Acknowledgements

This issue was discovered by Cedric Buissart (Red Hat).
Last Modified