CVE-2015-3163

The admin pages for power types and key types in Beaker before 20.1 do not have any access controls, which allows remote authenticated users to modify power types and key types via navigating to $BEAKER/powertypes and $BEAKER/keytypes respectively.

CVSS v3.1 NVD

4.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CVSS v2.0 NVD

4.0 MEDIUMAV:N/AC:L/Au:S/C:N/I:P/A:N

EPSS

1.09% chance of exploitation in the next 30 days, 65th percentile

Published

2017-09-06

Updated

2024-08-06

Proof-of-concept exploits (1)

• https://bugzilla.redhat.com/show_bug.cgi?id=1215034

Security advisories

• https://beaker-project.org/jenkins-results/beaker-review-checks-docs/995/documentation/_b…
• http://www.openwall.com/lists/oss-security/2015/05/08/1
• http://www.securityfocus.com/bid/74567

References

• CVE Record
• NVD entry