PT-2022-4658 · Unknown+9 · Pacemaker Configuration Tool+9

Published 2022-03-17 · Updated 2025-07-02 · CVE-2022-1049

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Pacemaker configuration tool (pcs) (affected versions not specified)

Description A flaw was found in the Pacemaker configuration tool, allowing expired accounts and accounts with expired passwords to login when using PAM authentication. This issue enables unprivileged expired accounts that have been denied access to still login. The vulnerability is related to deficiencies in the authentication procedure, which can be exploited by a remote attacker to elevate their privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

ALSA-2022:7447

ALSA-2022:7935

ALT-PU-2022-2143

ALT-PU-2023-5630

ALT-PU-2024-7827

BDU:2022-05543

CESA-2022_7447

CVE-2022-1049

DLA-3108-1

DSA-5226-1

OESA-2022-1886

RHSA-2022:7447

RHSA-2022:7935

RHSA-2022_7447

RHSA-2022_7935

RLSA-2022:7447

RLSA-2022:7935

USN-7614-1

Affected Products

Alt Linux

Almalinux

Astra Linux

Centos

Linuxmint

Pacemaker Configuration Tool

Red Hat

Red Os

Rocky Linux

Ubuntu

References · 82

• 🔥 https://huntr.dev/bounties/7aa921fc-a568-4fd8-96f4-7cd826246aa5 · Exploit
• https://linux.oracle.com/errata/ELSA-2022-10007.html · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2022:7447 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7614-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-1049 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-1049 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-1049 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7614-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1049 · Security Note
• https://osv.dev/vulnerability/DSA-5226-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:7447 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:7447 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-1086 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-1049 · Vendor Advisory