Описание
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
| Релиз | Статус | Примечание |
|---|---|---|
| artful | ignored | end of life |
| bionic | not-affected | 0.9.164-1 |
| cosmic | ignored | end of life |
| devel | not-affected | 0.10.1-2 |
| disco | not-affected | 0.10.1-2 |
| eoan | not-affected | 0.10.1-2 |
| esm-apps/bionic | not-affected | 0.9.164-1 |
| esm-apps/xenial | not-affected | vulnerable code not present |
| esm-infra-legacy/trusty | DNE | |
| precise/esm | DNE |
Показывать по
EPSS
4 Medium
CVSS2
8.7 High
CVSS3
Связанные уязвимости
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escal ...
pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
EPSS
4 Medium
CVSS2
8.7 High
CVSS3