PT-2023-21162 · Xcat · Xcat

Dr. Stefan Albensoeder · Publicado 2023-03-08 · Atualizado 2023-03-15 · CVE-2023-27486

Positive Technologies (AI Summary)

CVSS v3.1

8.1

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions xCAT versions prior to 2.16.5

Description xCAT is a toolkit for deployment and administration of computer clusters. If zones are configured as a mechanism to secure clusters in XCAT, it is possible for a local root user from one node to obtain credentials to SSH to any node in any zone, except the management node of the default zone. XCAT zones are not enabled by default, so only users that use the optional zone feature are impacted.

Recommendations For xCAT versions prior to 2.16.5, upgrade to version 2.16.5 to resolve the issue. As a temporary workaround for users unable to upgrade, consider disabling zones or patching the management node with the fix contained in commit 85149c37f49.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2023-27486

GHSA-HPXG-7428-6JVV

Produtos afetados

Xcat

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27486.json · Exploit
• 🔥 https://github.com/xcat2/xcat-core/issues/7246 · Exploit
• https://github.com/xcat2/xcat-core/pull/7247/commits/85149c37f49dbca7bd85f1f586960315604fc024 · Correção
• https://github.com/xcat2/xcat-core/pull/7247 · Correção
• https://github.com/xcat2/xcat-core/security/advisories/GHSA-hpxg-7428-6jvv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-27486 · Aviso do Fabricante
• https://t.me/cvenotify/46215 · Publicação no Telegram
• https://t.me/cvenotify/45816 · Publicação no Telegram
• https://t.me/cibsecurity/59692 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-27486 · Nota de Segurança