CVE-2020-35458

Опубликовано: 12 янв. 2021

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Средний

Описание

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There is a Ruby shell code injection issue via the hawk_remember_me_id parameter in the login_from_cookie cookie. The user logout routine could be used by unauthenticated remote attackers to execute code as hauser.

Ссылки

http://www.openwall.com/lists/oss-security/2021/01/12/3
Mailing List
Patch
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1179998
Issue Tracking
Patch
Third Party Advisory
https://github.com/ClusterLabs/hawk/releases
Release Notes
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/01/12/3
Mailing List
Patch
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/01/12/3
Mailing List
Patch
Third Party Advisory
https://bugzilla.suse.com/show_bug.cgi?id=1179998
Issue Tracking
Patch
Third Party Advisory
https://github.com/ClusterLabs/hawk/releases
Release Notes
Third Party Advisory
https://www.openwall.com/lists/oss-security/2021/01/12/3
Mailing List
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:clusterlabs:hawk:2.2.0-12:*:*:*:*:*:*:*

cpe:2.3:a:clusterlabs:hawk:2.3.0-12:*:*:*:*:*:*:*

EPSS

Процентиль: 94%

0.12988

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-78

Связанные уязвимости

CVE-2020-35458

CVSS3: 9.8

debian

около 5 лет назад

An issue was discovered in ClusterLabs Hawk 2.x through 2.3.0-x. There ...

openSUSE-SU-2021:0147-1

suse-cvrf

около 5 лет назад

Security update for hawk2

openSUSE-SU-2021:0144-1

suse-cvrf

около 5 лет назад

Security update for hawk2

openSUSE-SU-2021:0074-1

suse-cvrf

около 5 лет назад

Security update for hawk2

openSUSE-SU-2021:0054-1

suse-cvrf

около 5 лет назад

Security update for hawk2

EPSS

Процентиль: 94%

0.12988

Средний

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

CWE-78