Vulnerabilities

TI-2023-02175 CVE-2023-2319 · GHSA-6rhm-fw89-rh2q

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as…

MEDIUM 51

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as part of Red Hat Enterprise Linux 9.2 failed to include the fix for the Webpack issue CVE-2023-28154 (for PCS package), which was prev…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00974 Published 2023-05-17 Fixed

TI-2022-02533 CVE-2022-2735 · GHSA-7xr9-rmm4-cq6v

Incorrect default permissions in ClusterLabs/pcs

LOW 34

A vulnerability was found in the PCS project.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00318 Published 2022-09-06 Fixed CWE-276

TI-2022-00946 CVE-2022-1049 · GHSA-hhh9-rwf2-2pp5

Improper authentication in clusterlabs/pcs

MEDIUM 42

A flaw was found in the Pacemaker configuration tool (pcs).

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01969 Published 2022-03-25 Partial fix CWE-287

TI-2017-01907 CVE-2017-2661 · GHSA-qc8r-mjjf-5j6v

Cross-site scripting in ClusterLabs pcs

LOW 30

ClusterLabs pcs before version 0.9.157 is vulnerable to a cross-site scripting vulnerability due to improper validation of Node name field when creating new cluster or adding existing cluster.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.01176 Published 2018-03-12 Will not fix CWE-79

TI-2016-00647 CVE-2016-0721 · GHSA-25mh-8263-4259

Session fixation vulnerability in pcsd in pcs before 0.9.157.

MEDIUM 40

Session fixation vulnerability in pcsd in pcs before 0.9.157.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.02388 Published 2017-04-21 Partial fix CWE-384

TI-2016-00646 CVE-2016-0720 · GHSA-ww6q-37hf-xhwr

Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.

MEDIUM 41

Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01464 Published 2017-04-21 Partial fix CWE-352

Vulnerabilities

Filters

It was discovered that an update for PCS package in RHBA-2023:2151 erratum released as…

Incorrect default permissions in ClusterLabs/pcs

Improper authentication in clusterlabs/pcs

Cross-site scripting in ClusterLabs pcs

Session fixation vulnerability in pcsd in pcs before 0.9.157.

Cross-site request forgery (CSRF) vulnerability in pcsd web UI in pcs before 0.9.149.