Vulnerability Description
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
CVSS Score
8.5
HIGH
AV:N/AC:M/Au:S/C:C/I:C/A:C
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Pacemaker\/Corosync Configuration System Project | Pacemaker\/Corosync Configuration System | <= 0.9.139 |
Related Weaknesses (CWE)
References
- http://rhn.redhat.com/errata/RHSA-2015-1700.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1252813
- http://rhn.redhat.com/errata/RHSA-2015-1700.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1252813
FAQ
What is CVE-2015-5190?
CVE-2015-5190 is a vulnerability with a CVSS score of 8.5 (HIGH). The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
How severe is CVE-2015-5190?
CVE-2015-5190 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2015-5190?
Check the references section above for vendor advisories and patch information. Affected products include: Pacemaker\/Corosync Configuration System Project Pacemaker\/Corosync Configuration System.