PT-2017-6637 · Beaker · Beaker

Dan Callaghan · Published 2017-09-06 · Updated 2020-03-09 · CVE-2015-3163

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Beaker versions prior to 20.1

Description The issue concerns the lack of access controls on the admin pages for power types and key types in Beaker. This allows remote authenticated users to modify these types by navigating to the respective pages, such as $BEAKER/powertypes and $BEAKER/keytypes.

Recommendations For versions prior to 20.1, update to version 20.1 or later to resolve the issue.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2015-3163

Affected Products

Beaker

References · 5

• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1215034 · Exploit
• https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_build/html/whats-new/release-20.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-3163 · Security Note
• http://openwall.com/lists/oss-security/2015/05/08/1 · Note
• http://securityfocus.com/bid/74567 · Note