PT-2018-10147 · Pcs+4 · Pcs+4

Cédric Buissart

·

Published

2018-04-09

·

Updated

2025-07-02

·

CVE-2018-1086

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions pcs versions prior to 0.9.164 pcs version 0.10 and earlier
Description The issue concerns a debug parameter removal bypass in the pcsd service's REST interface. Specifically, the /run pcs query did not properly remove the pcs debug argument, which could potentially disclose sensitive information. A remote attacker with a valid token could exploit this flaw to elevate their privilege.
Recommendations For pcs versions prior to 0.9.164, update to version 0.9.164 or later to resolve the issue. For pcs version 0.10 and earlier, update to a version later than 0.10 to resolve the issue. As a temporary workaround, consider restricting access to the /run pcs query to minimize the risk of exploitation.

Fix

Information Disclosure

RCE

Weakness Enumeration

Related Identifiers

CESA-2018_1060
CESA-2018_1927
CVE-2018-1086
DSA-4169-1
DSA-4339-1
DSA-4339-2
RHSA-2018:1060
RHSA-2018:1927
RHSA-2018_1060
RHSA-2018_1927
USN-7614-1

Affected Products

Centos
Linuxmint
Red Hat
Ubuntu
Pcs