CVE-2017-2627CWE-22

A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11

High · published August 22, 2018

CVSS v3.0
8.2
EPSS
1%
Percentile
51.0
In the wild
Unconfirmed
What it is

A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11. The sudoers file as installed with OSP's openstack-tripleo-common package is much too permissive. It contains several lines for the mistral user that have wildcards that allow directory traversal with '..' and it grants full passwordless root access to the validations user.

The record
Technical detail
CVSS v3.0
8.2 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00661 · 51.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2018-08-22T17:00Z
EPSS history
Timeline
  • 22 AUG 17:00Z
    A flaw was found in openstack-tripleo-common as shipped with Red Hat Openstack Enterprise 10 and 11
    cvelistv5