CVE-2016-7035CWE-285

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface

High · published September 10, 2018

CVSS v3.0
8.8
EPSS
0%
Percentile
32.2
In the wild
Unconfirmed
What it is

An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface. An attacker with an unprivileged account on a Pacemaker node could use this flaw to, for example, force the Local Resource Manager daemon to execute a script as root and thereby gain root access on the machine.

The record
Technical detail
CVSS v3.0
8.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00395 · 32.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2018-09-10T16:00Z
EPSS history
Timeline
  • 10 SEP 16:00Z
    An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface
    cvelistv5