CVE-2015-5190 Command injection in n/a
Remote authenticated users can execute arbitrary commands via escape characters in the PCS web UI URL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-5190?
CVE-2015-5190 is a high-severity command injection vulnerability in n/a, published on 3 Sep 2015. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The pcsd web UI in PCS 0.9.139 and earlier allows remote authenticated users to execute arbitrary commands via "escape characters" in a URL.
Weakness: CWE-77
Which versions are affected by CVE-2015-5190?
It affects 1 product.
Products include Pacemaker\/Corosync Configuration System Project Pacemaker\/Corosync Configuration System.
How do I fix CVE-2015-5190?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2015-5190 being exploited?
There is no known exploitation of CVE-2015-5190 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-cr7h-75cf-wm8x.