PT-2025-34367 · Unknown · Mcsmanager

Bddjr · Publicado 2025-08-22 · Atualizado 2025-08-22 · CVE-2025-50691

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MCSManager version 10.5.3

Description: The MCSManager daemon process runs with root privileges by default. Sensitive data, including tokens and terminal content, is stored in a data directory accessible to all users. This allows unauthorized users to read the daemon’s key and potentially log in, leading to privilege escalation.

Recommendations: Ensure the MCSManager daemon process does not run with root privileges. Restrict access to the data directory containing sensitive information to authorized users only.

Correção

LPE

Incorrect Privilege Assignment

Enumeração de Fraquezas

CWE-266

Identificadores relacionados

CVE-2025-50691

Produtos afetados

Mcsmanager

Referências · 6

• https://github.com/MCSManager/MCSManager/pull/1596 · Nota
• https://github.com/bddjr/bddjr/discussions/9 · Nota
• https://twitter.com/CVEnew/status/1958895846738518359 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-50691 · Aviso do Fabricante
• https://t.me/CVEtracker/30678 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-50691 · Nota de Segurança