pcs before version 0.9.164 and 0.10 is vulnerable to a privilege escalation via authorized user malicious REST call. The REST interface of the pcsd service did not properly sanitize the file name from the /remote/put_file query. If the /etc/booth directory exists, an authenticated attacker with write permissions could create or overwrite arbitrary files with arbitrary data outside of the /etc/booth directory, in the context of the pcsd process.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.0 Base Score: 8.7
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade pcsUpgrade pcs-snmpUpgrade pcs-debuginfo | Apr 27, 2020 | Apr 12, 2018 |
| Centos_linux | — | Upgrade pcsUpgrade pcs-snmpUpgrade pcs-debuginfo | Jun 1, 2018 | Apr 10, 2018 |
| Debian | — | Upgrade pcs | Jul 30, 2024 | Apr 12, 2018 |
| Oracle_linux | — | Upgrade pcs-snmpUpgrade pcs | May 1, 2018 | Apr 9, 2018 |
| Redhat_linux | — | Upgrade pcs-snmpUpgrade pcs-debuginfoUpgrade pcs | Apr 11, 2018 | Apr 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub