Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-18823

Опубликовано: 27 апр. 2020
Источник: nvd
CVSS3: 9.8
CVSS2: 7.5
EPSS Низкий

Описание

HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods to include CLAIMTOBE, then it is possible to impersonate another user to the condor_schedd. (For example to submit or remove jobs)

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:wisc:htcondor:*:*:*:*:*:*:*:*
Версия от 8.8.0 (включая) до 8.8.6 (включая)
cpe:2.3:a:wisc:htcondor:*:*:*:*:*:*:*:*
Версия от 8.9.0 (включая) до 8.9.4 (включая)
Конфигурация 2

Одно из

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Конфигурация 3

Одно из

cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

EPSS

Процентиль: 86%
0.02816
Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287

Связанные уязвимости

CVSS3: 9.8
ubuntu
почти 6 лет назад

HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods to include CLAIMTOBE, then it is possible to impersonate another user to the condor_schedd. (For example to submit or remove jobs)

CVSS3: 9.8
debian
почти 6 лет назад

HTCondor up to and including stable series 8.8.6 and development serie ...

CVSS3: 9.8
github
больше 3 лет назад

HTCondor up to and including stable series 8.8.6 and development series 8.9.4 has Incorrect Access Control. It is possible to use a different authentication method to submit a job than the administrator has specified. If the administrator has configured the READ or WRITE methods to include CLAIMTOBE, then it is possible to impersonate another user to the condor_schedd. (For example to submit or remove jobs)

EPSS

Процентиль: 86%
0.02816
Низкий

9.8 Critical

CVSS3

7.5 High

CVSS2

Дефекты

CWE-287